# API tokens

API tokens let other software (your accounting system, a spreadsheet script, a BI tool) read your Invoice Hub data through the [API](/docs/api).

## Creating a token

1. Account menu → **API tokens** (needs the *API Tokens → Manage own tokens* permission).
2. Give the token a name, for example "Tally sync".
3. Tick the **scopes** it needs, such as `invoices.view` or `clients.view`. You can only grant scopes you hold yourself.
4. Choose an expiry: 7, 30, 90 or 365 days, or none.
5. Copy the key (it starts with `ydk_`). **It is shown once.**

## Good practice

- One token per integration, so you can revoke one without breaking the others.
- Grant the fewest scopes that work.
- If a key leaks, **revoke** it immediately and create a new one.

A key can never do more than its owner's current role allows. If your role loses a permission, your keys lose it too.