Authentication and Application tokens

This document explains how to authenticate DocStudio API requests with application and temporary authorization tokens.

Use application tokens for server-side integrations, backend services, automation, and long-running API access. Use /api/login for testing or short-lived sessions that require user credentials.

Choose a token type

Token type	Use for
Application token	Server-side integrations, backend services, automation, and long-running API access
Temporary authorization token	Testing, short-lived sessions, or requests that use user credentials

Authentication header

Use the same header format for both token types.

Authorization: Bearer {token}

The token identifies the caller. Endpoint permissions still control access to a mailbox, account, envelope, template, dictionary, domain, or attachment.

Manage application tokens

Use application tokens without sending a user password in every request. Store them only in secure server-side storage.

Do not expose token values in client-side code, mobile applications, repositories, logs, screenshots, tickets, shared documents, or frontend environment variables.

Application token endpoints return an application token object.

List application tokens

Method	Endpoint
GET	/api/v1/token

Response

Returns an array of application token objects.

Create application token

Method	Endpoint
POST	/api/v1/token

Request body

{
  "name": "string",
  "expireAt": "2026-07-21T13:42:40.621Z"
}

Field	Type	Required	Description
name	string	Yes	Application token name
expireAt	date-time	Yes	Token expiration date and time

Response

Returns an application token object. Copy and store the returned token value securely.

Revoke application token

Method	Endpoint
DELETE	/api/v1/token/{id}

Path parameters

Parameter	Type	Required	Description
id	UUID	Yes	Application token ID

Response

Returns 200 OK.

Configuration restriction

Application token methods can be disabled by configuration. The API then returns 405 Method disabled by configuration.

{
  "code": 0,
  "message": "string",
  "messageLocalized": "string",
  "messageArgs": [
    "string"
  ],
  "data": "string"
}

Field	Type	Description
code	integer	Error code
message	string	Error message
messageLocalized	string	Localized error message
messageArgs	array	Dynamic arguments used to build the message
data	any	Additional error data

This response schema applies to disabled application token methods only.

Temporary authorization tokens

Use /api/login to get a temporary authorization token with user credentials. The token expires after 3 hours.

Use application tokens for long-running integrations.

Method	Endpoint
POST	/api/login

Request body

{
  "login": "string",
  "password": "string"
}

Field	Type	Required	Description
login	string	Yes	User login
password	string	Yes	User password

Response

{
  "token": "string",
  "deviceId": "string"
}

Field	Type	Description
token	string	Temporary authorization token
deviceId	string	Device ID returned with the login response

Use the returned token value in the Authorization header.

Authorization: Bearer {authorization-token}

Resolve authentication and access errors

Code	Meaning	Action
401 Not authorized	The request is not authenticated	Check the header, token value, and token expiration
403 Forbidden	The token cannot access the resource or action	Check access to the required account, mailbox, or requested object
90035 Not a token owner	The current user cannot access the application token	Use a token from the correct user and account

Checklist

1. Confirm that the Authorization header uses the Bearer {token} format.

2. Confirm that the token value is valid and has not expired.

3. Confirm that the token and requested resource use the expected account and mailbox.

How to respond to an exposed token

1. Stop using the exposed token.

2. Create a new token and update the integration.

3. Revoke the exposed token and remove it from unsafe locations.

Related topics

• API token security

• Send your first envelope

• Authorization