​

Authentication

​

Creating an API Token

1. Log in to your Tokencraft dashboard
2. Navigate to API in the sidebar
3. Click “New Token”
4. Enter a descriptive name for your token
5. Click “Create Token”
6. Copy the token immediately - you won’t be able to see it again!

​

Token Format

dtk_[random_string]

​

Using Your Token

Authorization: Bearer dtk_your_token_here

​

Examples

curl -H "Authorization: Bearer dtk_your_token_here" \
  https://app.tokencraft.dev/api/v1/workspaces

​

Environment Variables

TOKENCRAFT_TOKEN=dtk_your_token_here
TOKENCRAFT_API_BASE=https://app.tokencraft.dev/api/v1

​

Token Permissions

• All workspaces owned by your account
• All tokensets within those workspaces
• All tokens and modes

​

Token Management

​

Viewing Active Tokens

• Token name
• Creation date
• Last used date
• Partial token display (first 12 characters)

​

Revoking Tokens

1. Go to Settings
2. Find the token in the list
3. Click the trash icon
4. Confirm deletion

​

Security Best Practices

​

✅ Do’s

• Store tokens in environment variables
• Use different tokens for different environments (dev, staging, production)
• Rotate tokens regularly
• Revoke tokens immediately if compromised
• Use secret management services (AWS Secrets Manager, HashiCorp Vault, etc.)

​

❌ Don’ts

• Never commit tokens to version control
• Never share tokens via email or chat
• Never log tokens in plain text
• Never use production tokens in development
• Never hard-code tokens in your application

​

Error Responses

​

401 Unauthorized

{
  "error": "Invalid API token"
}

• Token not provided in Authorization header
• Token format is incorrect
• Token has been revoked
• Token doesn’t exist

• Verify your token is correct
• Check the Authorization header format
• Generate a new token if necessary

​

429 Too Many Requests

{
  "error": "Rate limit exceeded. Please try again later."
}

​

CI/CD Integration

​

GitHub Actions

name: Sync Design Tokens

on:
  schedule:
    - cron: '0 0 * * *'  # Daily

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Download tokens
        run: |
          curl -H "Authorization: Bearer ${{ secrets.TOKENCRAFT_TOKEN }}" \
            "${{ secrets.TOKENCRAFT_API_BASE }}/tokensets/${{ secrets.TOKENSET_ID }}/modes/light/export?format=css" \
            -o src/tokens.css
      
      - name: Commit changes
        run: |
          git config user.name "GitHub Actions"
          git config user.email "[email protected]"
          git add src/tokens.css
          git diff --staged --quiet || git commit -m "Update design tokens"
          git push

​

GitLab CI

sync-tokens:
  script:
    - curl -H "Authorization: Bearer $TOKENCRAFT_TOKEN"
        "$TOKENCRAFT_API_BASE/tokensets/$TOKENSET_ID/modes/light/export?format=css"
        -o src/tokens.css
  only:
    - schedules

​

Rate Limiting

• 100 requests per minute per token
• Rate limit resets every 60 seconds
• Headers include rate limit information

​

Next Steps