> ## Documentation Index
> Fetch the complete documentation index at: https://clumio.reclear.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and rotate API tokens

> Create a Clumio API token, use it in a request, and rotate it safely.

Every request to the Clumio REST API, and every SDK call, authenticates with a signed JSON Web Token
sent as a bearer token.

## Send an authenticated request

```bash theme={null}
curl -X GET "https://us-west-2.api.clumio.com/users" \
  -H "Authorization: Bearer ${CLUMIO_API_TOKEN}"
```

## Generate a token

<Steps>
  <Step title="Open the token screen">
    In the Clumio console, go to **Administration → Access management → API tokens**.
  </Step>

  <Step title="Create the token">
    Generate a personal token for development or a service token for automation. Super Administrators
    and OU Administrators can generate service tokens.
  </Step>

  <Step title="Download and store it">
    Download the CSV when Clumio generates it. The full token can be downloaded only once. Store it in
    a secrets manager, never in a repository.
  </Step>
</Steps>

Tokens persist until you refresh or delete them. Deleting a token immediately invalidates every
script using it.

## Token types

| Type         | Use it for                                                                                |
| ------------ | ----------------------------------------------------------------------------------------- |
| **Personal** | Development and testing. Each user can have one personal token.                           |
| **Service**  | Production automation and third-party integrations. The default limit is ten per account. |

Use service tokens for unattended automation. Clumio deletes a personal token when its user account
is suspended or deleted.

Use the API base URL for the control plane that issued the token. See
[Supported regions](/reference/regions#api-base-urls).

API endpoints require TLS 1.3, or TLS 1.2 with ECDHE-AES-GCM cipher suites. See
[Deprecations](/changelog/deprecations#legacy-tls-12).

## Rotation

API tokens remain valid until they are refreshed or deleted. Clumio recommends refreshing them every
three months. Refreshing a token immediately invalidates the previous value.

<AccordionGroup>
  <Accordion title="Rotate a token">
    Refresh the token in Clumio, download the new CSV, and update every script or integration that
    uses it. Plan the deployment because the previous token stops working immediately.
  </Accordion>

  <Accordion title="Auditing token use">
    Service token activity is recorded in the audit log and can be reported on separately from human
    user activity. See Clumio's
    [service token audit report](https://documentation.commvault.com/clumio/api_tokens.html#service-token-audit-report).
  </Accordion>
</AccordionGroup>

## Next

<CardGroup cols={2}>
  <Card title="REST API overview" icon="square-terminal" href="/developer-tools/rest-api">
    Send a request and review the API conventions.
  </Card>

  <Card title="Supported regions" icon="globe" href="/reference/regions">
    Find the API base URL for your control plane.
  </Card>
</CardGroup>