Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.opnform.com/llms.txt

Use this file to discover all available pages before exploring further.

Personal Access Tokens are the credentials you’ll use to authenticate with the OpnForm REST API. They’re scoped, revocable, and tied to your user account – keep them secret.

​
Creating a token

  1. Sign in to your OpnForm account.
  2. Open Settings → Access Tokens (/home?user-settings=access-tokens).
  3. Click Create new token.
  4. Pick a descriptive name (e.g. “Zapier Integration”).
  5. Select the abilities you want to grant (see the table below).
  6. Click Create and copy the token value – you won’t be able to see it again after closing the dialog.
Create token

​
Abilities

AbilityGrants
workspaces-readList workspaces
workspaces-writeCreate, update or delete workspaces
workspace-users-readList members and invites
workspace-users-writeManage members and invites
forms-readList forms and submissions
forms-writeCreate or modify forms and submissions
You can combine abilities as needed – choose the minimum set your integration requires.

​
Using the token

Send the token in the Authorization header: 
Authorization: Bearer <access_token>

​
Revoking a token

If a token is leaked or no longer needed:
  1. Go back to Settings → Access Tokens.
  2. Click Revoke next to the token.
  3. Any further API requests that use that token will receive 401 Unauthorized.

​
Best practices

  • Store tokens securely (environment variables, secret managers, CI secrets).
  • Use a dedicated token per integration – easier to revoke individually.
  • Avoid committing tokens to version control.
  • Rotate tokens periodically.