# API Access token

API Access Token is a unique identifier assigned to a particular project or several projects in your account. It authenticates your account for managing your projects via the API, including account modifications, sending messages, editing projects, etc.

## API Access token types

Pushwoosh provides two different API Access Token types: **Server** and **Device**. 

Each token type is only valid for its specific API scope. An authentication error will occur if the incorrect token is used.

#### Server API token 

The Server API token is used with all API methods, except those under the Device API. It should be included in the request body in the `auth` field.


#### Device API token

The Device API token is used exclusively with Device API methods. It should be included in the HTTP request headers using the `Authorization` header.
Below is an example of the correct header format:

```
Authorization: Token <device_api_token>
```
Replace `<device_api_token>` with your actual Device API Token value.

<Aside type="caution" title="Methods requiring a Device API token">

The following API methods **require a Device API token** for authorization:
- [`registerDevice`](/developer/api-reference/device-api/#registerdevice)
- [`unregisterDevice`](/developer/api-reference/device-api/#unregisterdevice)
- [`deleteDevice`](/developer/api-reference/device-api/#deletedevice)
- [`setTags`](/developer/api-reference/device-api/#settags)
- [`getTags`](/developer/api-reference/device-api/#gettags)
- [`setBadge`](/developer/api-reference/device-api/#setbadge)
- [`applicationOpen`](/developer/api-reference/device-api/#applicationopen)
- [`pushStat`](/developer/api-reference/device-api/#pushstat)
- [`messageDeliveryEvent`](/developer/api-reference/device-api/#messagedeliveryevent)
- [`registerUser`](/developer/api-reference/user-centric-api/#registeruser)
- [`deleteUser`](/developer/api-reference/user-centric-api/#deleteuser)
- [`postEvent`](/developer/api-reference/user-centric-api/#postevent)
- [`registerEmail`](/developer/api-reference/email-api/#registeremail)
- [`deleteEmail`](/developer/api-reference/email-api/#deleteemail)
- [`setEmailTags`](/developer/api-reference/email-api/#setemailtags)
- [`registerEmailUser`](/developer/api-reference/email-api/#registeremailuser)
- [`getInboxMessages`](/developer/api-reference/message-inbox/#getinboxmessages)
- [`inboxStatus`](/developer/api-reference/message-inbox/#inboxstatus)
</Aside>

## Create and manage API Access tokens

You can view, create, and manage your API Access tokens in the **API Access** section of the Pushwoosh Control Panel. To access it, go to **Settings → API Access**.
![Pushwoosh Demo App token](/api-reference-api-access-token-1.webp)

By default, each account includes a token called **Pushwoosh Demo App**, which is set up as a server token.

### Create a new API Access token

To create a new API Access token:

1. Go to the **API Access** section in the Control Panel.

2. Click **Generate New Token**.

3. In the window that appears, choose the token type:

   * [**Server**](#server-api-token) used for most API methods (excluding Device API methods).

   * [**Device**](#device-api-token) used for Device API methods only.

4. Enter a name for the token.

5. Click **Generate** to create the token.

![Generate a New Token](/api-reference-api-access-token-4.webp)

> **Important:** Be sure to give the token access to the right app in your Pushwoosh Control Panel. [Learn more](#edit-token)

The new token will appear in the API Access list. From there, you can copy its value for use in API requests or manage its access permissions as needed.

### Manage a token

To manage an existing API token, click the **three-dot menu (⋮)** next to the token entry in the **API Access** section. 

![Manage a token](/api-reference-api-access-token-2.webp)

The following options are available:

#### Grant access to all projects

Gives the token access to all projects in your account. This allows it to fully use the API across all projects.

<Aside type="tip">
Only give full access to tokens that need it. This helps keep your data secure and access controlled.
</Aside>


#### Revoke access from all projects

Removes the token’s access to all projects in your account. The token will no longer be able to use the API until access is given again.

#### Edit token

Opens the **Edit API Token Permissions** screen, where you can:

* Change the token name

* Copy the token value

* Choose which projects the token can access by selecting or unselecting them in the list

![Manage a token](/api-reference-api-access-token-3.webp)

After you finish making changes, click **Save** to apply them.

<Aside type="tip">
Only give tokens access to the projects they need. This helps protect your account and control what each token can do.
</Aside>

#### Delete token

Permanently removes the token from your account.

<Aside type="caution">

This action cannot be undone. Once deleted, the token can’t be recovered. Make sure the token is no longer in use before deleting it.

</Aside>


## Authorizing API requests

To authorize API requests, use the correct type of API Access token based on the type of API method you are calling:

#### For Server API methods

Include the token in the "auth" field of the request body:

Example:

```json
{
  "request": {
    "application": "XXXXX-XXXXX",
    "auth": "yxoPUlwqm…………pIyEX4H", // paste your server token here
    "notifications": [{
      "send_date": "now",
      "content": "Hello world"
    }]
  }
}
```

#### For Device API methods

Use the **Device token**. Include it in the HTTP request header using the following format:

```
Authorization: Token <device_api_token>
```

Replace `<device_api_token>` with your actual token value.
<Aside type="caution">
Make sure the token type matches the API method you are using. If the token does not match the required type, the request will return an authentication error.
</Aside>