Personal API Tokens

Create long-lived tokens to use the RevOrbit API from scripts, integrations, and AI assistants.

Personal API tokens let you call the RevOrbit REST API from scripts, integrations, and AI assistants without handling your password or a short-lived login session. A token acts as you, inside the organization it was created in, and keeps working until it expires or you revoke it.

Create a Token

Tokens are created from your profile. The full token value is shown exactly once — copy it somewhere safe (a password manager or your integration's secret store) before closing the dialog.

1
Click your name in the top-right corner and select Profile
2
Switch to the API Tokens tab
3
Give the token a name that identifies where it will be used (e.g. \"Reporting script\")
4
Choose the Access level — Read & write or Read-only
5
Optionally pick an expiry (30 days, 90 days, or 1 year); the default is no expiry
6
Click Create, then copy the token from the green banner
Treat a token like a password. Anyone who has it can act as you in this organization (within the token's access level). If a token may have leaked, revoke it immediately — revocation takes effect on the next request.

Using a Token

Send the token as a Bearer token in the Authorization header on any API request, exactly as you would a login session token. Tokens start with rvo_ so you can recognize them in configs and logs.

1
Example: curl -H \"Authorization: Bearer rvo_...\" https://crm.revorbit.com/api/leads
2
See the full endpoint reference at api-docs.revorbit.com

Read-only vs Read & Write

A read-only token can list and view data but is rejected (HTTP 403) on every request that creates, updates, or deletes anything. Use read-only tokens for dashboards, reporting, and anything that only needs to look at your CRM. A read & write token can do what you can do in the app.

Managing and Revoking Tokens

The API Tokens tab lists your active tokens with their name, prefix, access level, last-used time, and expiry — but never the token value itself. You can hold up to 10 active tokens per organization.

1
Open Profile → API Tokens to review your tokens
2
Check Last used to spot tokens that are no longer needed
3
Click the ✕ button next to a token to revoke it — anything using it stops working immediately
For security, API tokens cannot be used to create or revoke other API tokens — token management always requires being logged in to the app. Tokens are also independent of your password: changing your password does not invalidate your API tokens.

Frequently Asked Questions