# API tokens

Create, manage, and rotate tokens for the API and MCP server. Learn the token format, the limits on each token, and what to do first if one leaks.

## Format

A token is `fs_` followed by 32 alphanumeric characters (35 in total). Send it as a bearer token:

```text
Authorization: Bearer fs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

The same header works for [the API](https://formstep.io/docs/developers/rest-api/) and the [MCP server](https://formstep.io/docs/developers/mcp-server/). Only a SHA-256 hash is stored, so a lost token cannot be recovered. Create a new one.

## Limits

- Each person can hold 10 tokens per workspace. Access tokens issued when you connect an OAuth app (`fso_...`) sit on the same page but do not count.

- You pick the expiry when you create the token: 30 days, 90 days or No expiration. There is no extend button: to change it, create a new token and delete the old one. A token that runs an unattended integration, such as an n8n workflow, should use No expiration.

- A token is bound to the workspace it was created in. A call that names another workspace, or a form in one, fails with `FORBIDDEN`, even when you are a member of both.

- A token has no scopes: it does everything you can do in that workspace. There is no read-only token.

> **Every plan has API access**
>
> Creating and using tokens is not limited by plan. Individual calls still are: scheduling request reminders needs Pro or Business, for example, and answers with `UPGRADE_REQUIRED` otherwise.

## Create a token

1. **Open OAuth and API Keys**

   In the sidebar, under your workspace. Tokens live in the API Keys card.

2. **Click Create token**

   Name it in the Create API token dialog, for example "CI/CD Pipeline" or "n8n production", and pick how long it lasts under Expiration: 30 days, 90 days or No expiration.

3. **Copy it now**

   The API token created dialog shows the value once. Copy & Close, and the value is gone for good.

4. **Store it in your secrets manager**

   Never commit it, and never ship it to a browser.

The list then shows the name, the first 11 characters, when it was created, and when it expires, or **Never expires**. An expired token is marked **Expired** and stops authenticating.

## Rotate a token

1. **Create the replacement**

   Give it a name that says which generation it is, like "n8n production v2".

2. **Roll it out**

   Update every consumer. Both tokens work while you switch.

3. **Delete the old one**

   Use the trash icon on its row and confirm in Delete API token?.

## Revoke a token

Deleting a token removes it permanently and it stops working on the next call. There is no grace period, and anything still using it starts getting `401 UNAUTHORIZED`. You can also rename a token with the pencil icon (up to 64 characters); renaming does not change its value.

Only you see your own tokens. Workspace admins cannot list or delete them. Leaving the workspace, or being removed from it, deletes them for you.

> **A token is full access**
>
> Anyone holding it can act as you inside that workspace. If one leaks, delete it first and investigate second.

## OAuth instead

A third-party app connecting on behalf of a user should use the OAuth flow instead of asking for a token. It gets an `fso_...` access token, valid one hour and refreshable for 30 days, bound to the one workspace the user picked at consent. The user sees and disconnects those apps in **Connected apps** on the same page. See [MCP server](https://formstep.io/docs/developers/mcp-server/#oauth).

## Next steps

[MCP server](https://formstep.io/docs/developers/mcp-server/) — Use Formstep from AI agents

[Webhooks reference](https://formstep.io/docs/developers/webhooks-reference/) — Payload schema and signing