Authentication
Create, use and delete API tokens.
Every request to the Data Export API needs an API token in the Authorization header:
Authorization: Bearer ph_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxA token always starts with ph_, followed by 48 characters.
Create an API token
Only owners and admins of an account can manage API tokens. API access is included in the Enterprise plan.
Step 1: Open the account management and scroll to the API access box.
Step 2: Under Token name, enter a name that tells you later what the token is used for, for example BI export.
Step 3 (optional): If your account has several projects, you can limit the token to individual projects under Restrict to projects (optional). Without a selection, the token covers all projects of the account, including ones created later.
Step 4: Click Create token.
Step 5: Copy the token with Copy and store it securely, for example in a password manager or as a secret in your tool. For security reasons, it is shown only this once.
Treat the token like a password: it gives read access to all responses of the projects it covers, including transmitted user attributes such as email addresses. Don't put it in public code or in the browser.
Rules for API tokens
- A token belongs to the account, not to a person. It stays valid when the person who created it leaves the account.
- A token covers all projects of the account or only the projects it was restricted to when it was created. The restriction cannot be changed afterwards. In that case, create a new token.
- A token has read-only access. Nothing can be changed or deleted via the API.
- Tokens don't expire. They stay valid until you delete them.
- An account can have at most 20 tokens.
In the API access box, you can see for each token who created it and when, which projects it covers and when it was last used.
Delete an API token
In the API access box, click Delete token for the token and confirm. The token stops working immediately. Applications using it lose access.
If a token may have fallen into the wrong hands, delete it immediately and create a new one.
Authentication errors
| Status | Meaning |
|---|---|
401 | The token is missing or invalid, for example because it was deleted. |
403 | The plan of the account does not include API access. |
404 | The survey belongs to another account or to a project the token has no access to. |
Learn more about errors in Basics.