API Keys

Personal Access Tokens are the credentials you’ll use to authenticate with the OpnForm REST API. They’re scoped, revocable, and tied to your user account – keep them secret.

​

Creating a token

1. Sign in to your OpnForm account.
2. Open Settings → Access Tokens (/settings/access-tokens).
3. Click Create new token.
4. Pick a descriptive name (e.g. “Zapier Integration”).
5. Select the abilities you want to grant (see the table below).
6. Click Create and copy the token value – you won’t be able to see it again after closing the dialog.

​

Abilities

You can combine abilities as needed – choose the minimum set your integration requires.

​

Using the token

Send the token in the Authorization header:

Authorization: Bearer <access_token>

​

Revoking a token

If a token is leaked or no longer needed:

1. Go back to Settings → Access Tokens.
2. Click Revoke next to the token.
3. Any further API requests that use that token will receive 401 Unauthorized.

​

Best practices

• Store tokens securely (environment variables, secret managers, CI secrets).
• Use a dedicated token per integration – easier to revoke individually.
• Avoid committing tokens to version control.
• Rotate tokens periodically.