# Create an API token

Create a personal API token for scripts and tools such as rclone, choose what it can access, and revoke it when you no longer need it.

Updated: 2026-10-19  
Source: https://drime.cloud/support/integrations-and-api/api-tokens

An API token lets a script or a tool, such as rclone, access your Drime account without your password. You choose what each token can do, and you can revoke it at any time.

Personal tokens are for your own scripts, backups and tools, working on your own account. An app that other Drime users connect to their accounts uses OAuth instead, and must never ask for their password: see the [Drime API documentation](https://docs.drime.cloud/authentication).

## Create a token

1. At the top right, click your avatar, then **Settings**.

2. Click **Developers**.

3. In **API access tokens**, click **Create token**.

   ![Settings, Developers, with the API access tokens section and the Create token button](https://drime.cloud/media/01M5A9VZ3EXT7ZMZHRBK5B9MS0/7ada18a14def-web-settings-developers-tokens.png)

4. In **Token name**, give the token a name you will recognise.

   Use the tool or the computer that uses it, for example "rclone on my NAS". The name must be 3 to 100 characters long.

5. Under **Permissions**, choose what the token can do.

   - **All**: full access to all resources.
   - **Read Only**: read-only access to all resources.
   - **Restricted**: access only to the resources you pick, each set to **No Access**, **Read** or **Write**.

   See [Choose the right permissions](#permissions).

   ![The Create new token dialog with a token name and the Permissions tabs](https://drime.cloud/media/01M59T977CYEFV0EGJSEE6Y0F7/1767ae179cc0-web-settings-developers-token-dialog.png)

6. Click **Create**.

7. Click **Copy** to copy the token, then click **Done**.

   The button shows **Copied!** once the token is in your clipboard.

   ![The new token shown once, with the Copy button and the warning to store it in a safe place](https://drime.cloud/media/01M5A9VVN2VHMPSB1CPTQWH2G4/45e6a99fae24-web-settings-developers-token-shown-once.png)

> **Important**
>
> The token is shown only once: **Make sure to store the token in a safe place. After this dialog is closed, token will not be viewable anymore.** Store it in a password manager or in your tool's configuration right away. If you lose it, delete it and create a new one.

The token then appears in **API access tokens**, and works right away. It does not expire: it works until you delete it.

## Choose the right permissions

Give a token only what it needs.

| Permission | What the token can do |
| --- | --- |
| **All** | Everything your account can do through the API. |
| **Read Only** | Read every resource listed below, but change nothing. |
| **Restricted** | Only the resources you set to **Read** or **Write**. Everything left on **No Access** is refused. |

A **Restricted** token lists these resources: **Files** (including versions and trash), **Folders**, **Sharing**, **Workspaces**, **Vault**, **Sign**, **Whiteboards**, **File requests**, **Send & Track**, **Contacts**, **Tags** and **Analytics**. **Analytics** (storage usage) can only be read, so its choices are **No Access** and **Access**. Hover the help icon next to a resource to see what it covers.

Only an **All** token can reach your account, security and billing settings. **Read Only** and **Restricted** tokens never can.

A token's permissions cannot be changed after it is created. To change them, create a new token with the right permissions, update your tool, then delete the old token.

## Use the token

Send the token in the `Authorization` header of every request:

```
Authorization: Bearer YOUR_ACCESS_TOKEN
```

The **Documentation** link next to **API access tokens** opens the [Drime API documentation](https://docs.drime.cloud/authentication). To use a token with rclone, see [Rclone, Drime CLI and WebDAV](https://drime.cloud/support/integrations-and-api/rclone-cli-and-webdav).

## See and delete your tokens

**API access tokens** lists the tokens you created and the ones the Drime apps create for themselves: Drime Desktop, Drime Mobile and the browser extension. Each row shows:

- the token's name, or the app and its platform, for example **Desktop app · Windows**;
- its permission, for example **All access**;
- when it was last used, or **Never used**.

If you have none, the section shows **You have no personal access tokens yet**.

To revoke a token:

1. Click **Delete token** (the bin icon) at the end of its row.

   ![The Delete token? confirmation dialog](https://drime.cloud/media/01M5A9VQDKFSB11N67Y0PAC592/fe208ec6869e-web-settings-developers-delete-token.png)

2. Click **Delete** to confirm.

   The dialog warns: **This token will be deleted immediately and permanently. Once deleted, it can no longer be used to make API requests.** **Token deleted** appears, and any tool using that token stops working at once.

You can also sign out the Drime apps from [See and sign out your sessions and devices](https://drime.cloud/support/account-and-settings/sessions-and-devices).

## If it doesn't work

| What you see | What to do |
| --- | --- |
| **API access tokens** is not in **Developers** | API access is not enabled for your account. [Contact Drime support](https://drime.cloud/support/getting-started/contact-drime-support). |
| You lost the token | It cannot be shown again. Delete it, then create a new one. |
| **Create** shows an error under **Token name** | The name must be 3 to 100 characters long. |
| `401` with `Unauthenticated.` | The token is missing, wrong or was deleted. Check the `Authorization: Bearer` header, or create a new token. |
| `403` with `This API key is missing the required scope: files.write` (or another resource) | The token is **Read Only** or **Restricted** and lacks that resource. Create a token with that resource set to **Read** or **Write** (the message names it), or with **All**. |
| `403` with `This endpoint cannot be accessed with a restricted API key.` | This part of the API, such as account or billing settings, needs an **All** token. |
| `403` with `This action is unauthorized.` | Your account itself is not allowed to do this, whatever the token. |

## Next steps

- [Rclone, Drime CLI and WebDAV](https://drime.cloud/support/integrations-and-api/rclone-cli-and-webdav)
- [See and sign out your sessions and devices](https://drime.cloud/support/account-and-settings/sessions-and-devices)