Skip to main content
API tokens are a lightweight alternative to OAuth applications for authenticating with the Privy API. Instead of exchanging client credentials for a short-lived OAuth access token, you generate a longer-lived token directly from the dashboard and use it immediately.

​
Creating a token

1

Open API token settings

Navigate to Settings > API Tokens in your Privy dashboard.
2

Create a new token

Click Create Token. Choose a descriptive name, select the scopes you need, and pick an expiration period.
3

Copy the token

The token is displayed once after creation. Copy it immediately and store it securely — you won’t be able to view it again.
Treat API tokens like passwords. Never share them in client-side code, public repositories, or URLs. If a token is compromised, revoke it immediately from the dashboard.

​
Token format

API tokens use the prefix privy_ followed by a 40-character hex string:

​
Scopes

Scopes control what your token can access. You select scopes when creating the token.

​
Using a token

Include the token in the Authorization header as a bearer token — exactly the same as an OAuth access token:
All API endpoints accept API tokens and OAuth access tokens in the same Authorization header format.

​
Expiration

When creating a token, choose from the following lifetimes: Tokens that were created with an expiration can be renewed from the dashboard to extend them by their original duration.

​
Revoking a token

You can revoke a token at any time from Settings > API Tokens in the dashboard. Revoked tokens are rejected immediately — any request using a revoked token receives a 401 error.

​
Limits

Each Privy account can have up to 25 active API tokens at a time. Revoked and expired tokens do not count toward this limit. Rate limits apply to API tokens the same way they apply to OAuth access tokens — all requests under the same account share the same rate limit budget.

​
Error responses

See the Errors page for all error codes.