API tokens: what they can and cannot do
API tokensAPI tokens: what they can and cannot do; Revoking an API token.
API tokens let scripts add transfers, list your library, and work with files. Create them from the Security section of Account.
Using one
Authorization: Bearer gt_...
Add a torrent with POST /api/on-demand, sending either a magnet link or a base64-encoded .torrent file. List your library with GET /api/library, and get a download link with GET /api/files/{id}/download.
POST /api/on-demand {"magnet": "magnet:?xt=urn:btih:..."}
What it can reach
API tokens can add transfers, list your library, and fetch files. They cannot change account settings, sessions, two-factor authentication, or billing.
It is shown once
The token value is shown only when you create it. If you lose it, revoke it and create a new one.
Careful: API activity uses the same plan limits as activity in the app. Automation must also follow the fair use policy.
Revoking an API token
Revoking takes effect on the next request, and cannot be undone.
Revoking a token stops it immediately and permanently. Anything using that token will need a new one.
With more than one token, Revoke all tokens under Account stops them together. Changing or resetting your password also revokes every token at once, so access set up by someone who knew the old password stops too. Sign out everywhere ends sessions only; your tokens keep working.
Revoke immediately if
- The token was committed to a repository, pasted into a chat, or included in a log.
- You no longer run the script it was made for.
- You cannot account for activity on your account.
Tip: Use a separate token for each script so you can revoke one without affecting the others.