How to create an API token

Create an API token when another system needs to read or write data in your Drum account. The token acts as the Drum user who creates it, with that user’s permissions.

Before you begin

You need:

• To be an account admin, or to have a role with at least one API permission (api_read, api_create, api_update or api_delete)
• To be signed in as the user the integration should act as

We recommend a separate Drum user for each integration, with a role that holds only the permissions it needs. See Recommended setup for an integration.

Create the token

1. Open your user menu and select Profile.
2. Select API in the settings menu.
3. Select Create an API Token.
4. In Token Name, enter a name that says what the token is for, such as “Xero cost sync”.
5. In Account, select the account the integration will work in. You cannot change this later.
6. Under Toolsets, leave the default unless an AI client will use this token. The REST API ignores this setting.
7. Select Generate New API Token.

Drum opens the token’s page.

1. Select the copy button next to the token, and store the token in your integration’s secrets store.

Check it works:

curl -H "Authorization: Bearer YOUR_API_TOKEN" \
  https://app.getdrum.com/api/v1/projects

A 200 response with a JSON array means the token works. See Make your first API request for a full walkthrough.

Rename a token

1. Open Profile, then API, and select the token.
2. Select Edit Token.
3. Change Token Name and select Update API Token.

Revoke a token

Revoke a token when an integration is retired, or straight away if the token may have been exposed.

1. Open Profile, then API, and select the token.
2. Select Revoke Token and confirm.

The token stops working at once. Requests with it return 401. Create a new token for the integration if it still needs access.

Troubleshooting