The Compute API uses bearer token authentication. Every request must include an API token in the Authorization header.
Bearer tokens let the API identify who is making the request and which Compute resources that user or organization can access.
<Warning> Treat API tokens like passwords. Anyone with a valid token may be able to access or change Compute resources linked to that token. </Warning>
Add your token to each request like this:
For example:
Use an environment variable
For local testing, you can store your token in an environment variable so you don’t paste it into every command.
Then use it in your request:
Environment variables are useful for local testing, but they’re not a full secrets-management system. For production workflows, store API tokens in the secret manager used by your deployment environment.
Check that your token works
Use a read-only endpoint, such as GET /instances, to test authentication.
If the token is valid, the API returns 200 OK.
A successful response may still contain an empty data array. That usually means the token works, but there are no matching resources visible to the account or organization.
Understand access
A token can only access resources allowed by the user, organization, or access policy behind it.
If a request succeeds for one resource but fails for another, the token may be valid but may not have access to that specific resource.
For example:
Common authentication errors
Keep tokens safe
Follow these basic rules when working with API tokens:
- Don’t commit tokens to Git or other source control.
- Don’t paste tokens into public issues, chat messages, or shared documents.
- Don’t expose tokens in frontend code or mobile apps.
- Don’t store tokens in plain text if your tool supports encrypted secrets.
- Rotate tokens if they may have been exposed.
- Revoke tokens you no longer use.
Never put a Compute API token in client-side code. Anyone who can inspect the app or webpage may be able to copy the token.
Rotate or revoke tokens
Rotate a token when you want to replace it with a new one. Revoke a token when it should stop working.
You should revoke a token when:
- A team member no longer needs access
- A script or integration has been retired
- A token was shared by mistake
- A device or environment that stored the token may be compromised
After revoking a token, update any scripts or integrations that still depend on it.
Next step
Continue with Work with instances to understand how instance lifecycle states behave when you use the API. 
