API Keys

Personal Access Tokens are the credentials you'll use to authenticate with the SharaForms REST API. They're scoped, revocable, and tied to your user account – keep them secret.

#Creating a token

1. Sign in to your SharaForms account.
2. Open Settings → Access Tokens (/home?user-settings=access-tokens).
3. Click Create new token.
4. Pick a descriptive name (e.g. "Zapier Integration").
5. Select the abilities you want to grant (see the table below).
6. Click Create and copy the token value – you won't be able to see it again after closing the dialog.

#Abilities

You can combine abilities as needed – choose the minimum set your integration requires.

#Using the token

Send the token in the Authorization header:

Authorization: Bearer <access_token>

#Revoking a token

If a token is leaked or no longer needed:

1. Go back to Settings → Access Tokens.
2. Click Revoke next to the token.
3. Any further API requests that use that token will receive 401 Unauthorized.

#Best practices

• Store tokens securely (environment variables, secret managers, CI secrets).
• Use a dedicated token per integration – easier to revoke individually.
• Avoid committing tokens to version control.
• Rotate tokens periodically.