API tokens
An API token is a key for a bot or a script. With it, a program does what you do in the panel: reads your servers, restarts them, sends console commands, renews rentals. Your password never leaves your hands.
Creating a token
Account menu → Settings → the API tokens tab.
- Connect to AI — a token with a ready-made set of scopes for an AI assistant, see AI assistants (MCP).
- Create token — a new token from scratch.
- The token card: scopes, projects, expiry, when it was last used and how much it has spent.
- Edit the scopes and limits, or revoke the token (bin).
A token is created in two steps.
Step 1. Name and access
- The form steps — you can switch between them.
- Name — something you'll recognise, like "Discord bot" or "CI deploy".
- Expires — 30, 90 or 365 days, or never.
- Projects — all or selected only. On a selected project you can click Pick services and let the token reach only specific servers.
- Allowed IPs — one per line, CIDR ranges work. Empty means any address.
Click Next.
Step 2. Scopes
- A group's switch turns on its main scopes.
- Configure expands the group's individual scopes.
- Dangerous scopes — spending the balance, deleting projects and services — are highlighted in red and aren't turned on by the group switch: you tick them by hand.
- Spending limit — appears once
billing:spendis ticked. - Create.
After creating it, copy the token with the Copy button.
The token is shown once. We keep only its fingerprint and can't show it again. Lost it? Revoke it and make a new one.
Every new token sends you an email, and a Telegram message if Telegram is linked. If you didn't create it, revoke it and change your password.
Scopes
| Group | Scope | Allows |
|---|---|---|
| Account | account:read | Profile, balance, summary, referral programme |
account:write | Changing the profile, language and notification settings | |
| Billing | billing:read | Payment and purchase history |
billing:topup | Creating top-up links (you pay them yourself) | |
billing:spend | Spending the balance: renting, renewing, changing plans | |
| Projects | projects:read | Listing projects |
projects:write | Creating and renaming projects | |
projects:delete | Deleting projects | |
projects:members | Adding and removing members | |
| Servers | servers:read | Services, status, usage, startup, backups, tasks |
servers:power | Start, stop, restart | |
servers:manage | Rename, reinstall, port, IP, startup parameters | |
servers:console | Console connection and commands | |
servers:files | Reading and writing server files (configs, plugins) | |
servers:access | Server access and SFTP details | |
servers:cron | Scheduled tasks | |
servers:backups | Creating, restoring and deleting backups | |
servers:delete | Deleting services | |
| FastDL | fastdl:read / fastdl:write | Reading FastDL / compressing files |
| Support | support:read / support:write | Reading tickets / new tickets and replies |
A token can never do more than you can. If you're removed from a project, the token loses it too.
Spending limit
billing:spend only comes with a limit: per 24 hours, per 30 days, or both. A purchase that would take the token past it is refused and nothing is charged. What each token has spent shows in the token list.
Projects, IPs and expiry
- Projects. A token limited to some projects can't see the others or create new ones. If specific services are selected in a project, the token sees only those and changes nothing at the project level.
- IP addresses. One address or CIDR range per line. Requests from anywhere else are refused.
- Expiry. 30, 90 or 365 days, or never. An expired token simply stops working.
What a token can't do
Signing in and out, sessions, changing your password or email, two-factor, passkeys, linking Telegram, deleting the account and managing tokens themselves — all of that stays with you, in the browser.
Next: the API overview, errors and status codes and the method reference.