API tokens

An API token is a key an external service uses to call the tracker API without logging in to the panel. Tokens are in Settings → API («Настройки → API»), the API tokens («API-токены») block. To open the section, see How to open the settings. Owners and admins can see the section.

Creating a token

1. Open Settings → API.
2. Click + Token («+ Токен»). The “Create API token” («Создать API-токен») window opens.
3. Fill in Name («Название»), for example, with the name of the integration. Length — up to 200 Latin characters or up to 100 Cyrillic ones.
4. Choose Access («Доступ»): Summary reports («Сводные отчёты»), MCP · reports for AI («MCP · отчёты для AI») or Full access («Полный доступ»). The default is Summary reports.
5. Choose Expiration («Срок действия»): 7 days («7 дней»), 30 days («30 дней»), 90 days («90 дней») or 365 days («365 дней»). The default is 90 days.
6. Click Create («Создать»).

The “New token — copy it now, it will not be shown again:” («Новый токен — скопируйте сейчас, повторно его не показать:») block appears above the list.

If you chose MCP · reports for AI access, there is a Connection URL («URL подключения») field under the Access list — the address you enter in the AI client. More on the MCP reports page.

Saving the token

1. Click Copy («Копировать») in the block with the new token. The button changes to “✓”.
2. Paste the token into your integration's settings or into a password manager.
3. Close the block with the ✕ icon with the “Hide” («Скрыть») tooltip.

A token looks like trk_ followed by 40 characters: digits and letters from a to f. The full token is shown only once. The block disappears when you close it, switch to another tab or reload the page, and the next token you create replaces the previous one in it. Only the first 12 characters remain in the list.

Which access to choose

Access is set at creation and does not change afterwards. A token has one access type.

The exact list of methods and report fields for Summary reports and Full access is on the Admin API: overview and authorization page. MCP · reports for AI access is described on the MCP reports page.

Using the token

Pass the token in the Api-Key header of every request to the panel domain:

curl https://panel.example.com/api/v1/conversion-types \
  -H "Api-Key: trk_0123456789abcdef0123456789abcdef01234567"

The request returns the list of conversion types and works for Summary reports and Full access tokens. A successful response is code 200. The base URL and other examples are on the Admin API: overview and authorization page.

An MCP · reports for AI token will not run this request: it is accepted only at the MCP address. Its headers and a test request are on the MCP reports page.

The request runs on behalf of the user who created the token, with that user's current role.

Token list

The list shows the tokens of the whole team, newest first. An owner or admin can revoke any of them. A token row shows:

• the name;
• the access type and expiration: “Until” («До») and a date for a valid token, “Expired” («Истёк») and a date for an expired one, “No expiration · legacy token” («Без срока · старый токен») for a token without an expiration;
• the first 12 characters of the token, “created” («создан») with the creation date and “used” («использован») with the date of the last request. If the token has not been used yet, “—” is shown instead of the date.

An expired token stays in the list until it is revoked. While there are no tokens, the block says “No tokens.” («Токенов нет.»).

When a token stops working

• The expiration has passed. The expiration cannot be changed: create a new token and replace the old one in the integration.
• The token was revoked.
• The token's creator was removed from the team or their role became lower than admin. Their tokens are deleted; if the role is given back, the tokens have to be created again. More about roles on the Team and roles page.

In all three cases the request gets a 401 response with the message invalid api key.

A separate case is an inactive license: tokens are not deleted, but requests get a 402 response. After the renewal, tokens whose expiration has not passed keep working. More on the License expiry: what is closed and what keeps working page.

Revoking a token

1. Find the token in the list by its name or first characters.
2. Click the ✕ icon with the “Revoke” («Отозвать») tooltip in its row.
3. Confirm the action in the “Revoke token “…”? All integrations using it will stop working.” («Отозвать токен «…»? Все интеграции с ним перестанут работать.») window.

The token disappears from the list and stops being accepted immediately. A revoked token cannot be brought back.

Checking the token

1. Send the request from the Using the token section with the new token. A response with code 200 means the token works. For an MCP · reports for AI token, use the request from the MCP reports page.
2. Open Settings → API again: the list refreshes when you open the tab.
3. Look at the token row: the word “used” is followed by the date and time of the request.

Audit log entries

Creating and revoking a token are recorded in Logs → Audit log («Логи → Audit log») with the action create or delete and the resource api-tokens. Requests with the token sent with the POST, PUT, PATCH and DELETE methods are recorded there too: the Context («Контекст») column shows API for them, and the User («Пользователь») column shows the creator's login and the beginning of the token in square brackets. More on the Audit log: user action log page.

Troubleshooting

invalid api key

The token was entered incorrectly, has expired or was revoked, or its creator was deleted or is no longer an owner or admin. Compare the beginning of the token with the rows of the list. If the token is not in the list or shows “Expired”, create a new one.

API token scope does not allow this action

The method is not covered by the token's access. For example, a Summary reports token called a method that needs Full access. Create a token with the access you need. A Full access token gets the same message when it tries to create a new token or log in as a user: these actions are done only in the panel.

An MCP · reports for AI token gets this message on any API method except the MCP address, and a token with any other access gets it at the MCP address.

report includes fields outside the aggregate report scope

A Summary reports token requested a report with a grouping or filter that is closed to it, for example by sub_id_1 or ip. Remove that field or use a Full access token. The allowed fields are in the Summary reports access limits section.

name is too long

The name is longer than 200 Latin or 100 Cyrillic characters. Shorten it and click Create again.

expires_at must be in the next 365 days

The message appears with the 365 days expiration if the clock on your computer is ahead, even by a few seconds: the expiration is counted from the computer's time, and the tracker checks it against its own time. Synchronize the time on your computer or choose 90 days.