Pradra StudioDocs
Sign in

API tokens

Your application shouldn't sign in with a person's password. An API token is a long-lived credential made for machines: create one, put it in your service's configuration, and call deployed capabilities with it.

What a token looks like

aif_1a2b3c4d.9f8e7d6c5b4a39281706f5e4d3c2b1a0

Use it exactly like a sign-in token, in the Authorization header:

curl -X POST https://your-host/api/v1/predict/CAPABILITY_KEY \
  -H 'Authorization: Bearer aif_1a2b3c4d.9f8e...' \
  -H 'Content-Type: application/json' \
  -d '{"inputs":{"age":30,"income":50000}}'

Shown once, stored hashed

When you create a token, the full value is displayed once. Copy it then — the platform stores only a hash and can never show it again. A lost token isn't recovered; it's revoked and replaced. This is a feature: a credential the platform cannot reveal is a credential a breach cannot reveal either.

Working with tokens in the Studio

  1. Open your profile menu (top right) → API Tokens.
  2. Create a token and give it a name that says who uses it — billing-service-prod, not token2.
  3. Copy the value into your application's secret configuration (never into source code).
  4. The list shows each token's name, prefix, and last use. Revoke anything you no longer recognize — revocation is immediate.

Good hygiene

  • One token per application. When a service is retired or compromised, you revoke its token without breaking anything else.
  • Rotate on people changes. Tokens don't belong to people, but people knew them; rotate when someone with production access leaves.
  • Treat tokens like passwords in your own systems: environment variables or a secret manager, never a repository or a chat message.

Note the direction of use: API tokens are how your systems call Pradra Studio. Credentials the platform uses to reach your databases and providers live in Secrets.

Next