> ## Documentation Index
> Fetch the complete documentation index at: https://docs.carbide.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an API token

> Generate an organization API key and use it to query Carbide.

Use an API key as your bearer token when connecting to Carbide's GraphQL API.
Each key belongs to one organization, so you don't need to send an organization
ID with your requests.

## Generate a key

You must be an active **owner** or **admin** of the organization to create or
manage API keys.

**1. Open API settings**

Sign in to [Carbide](https://app.carbide.work), select your organization, and
open **Settings → Organization → API**.

[Go to API keys](https://app.carbide.work/settings/organization/api#api-keys).

**2. Generate an API key**

In **API keys**, select **Generate API key**. Give the key a name that
identifies its purpose, then choose an expiration. The default is 90 days.

Leave the MCP permission options unchecked when following this GraphQL
quickstart; those options control access through AI clients.

**3. Copy your token**

Copy the complete key, including its `carbide_` prefix, and store it securely.

> [!WARNING]
>
> Carbide shows the key only once. After you close the dialog, you cannot
> retrieve it again. If you lose it, generate a replacement and revoke the
> old key.

## Authenticate requests

Send your key in the `Authorization` header:

```http theme={null}
Authorization: Bearer carbide_YOUR_API_KEY
```

GraphQL requests use `POST https://app.carbide.work/graphql` with a JSON body.
For example, set `CARBIDE_API_KEY` to your key in your local environment and run:

```bash theme={null}
curl https://app.carbide.work/graphql \
  --header "Authorization: Bearer ${CARBIDE_API_KEY}" \
  --header "Content-Type: application/json" \
  --data '{"query":"query { listRequests(first: 10) { count } }"}'
```

This read-only query returns the request count for the key's organization.

## Use the GraphQL explorer

Open the [GraphQL explorer](https://app.carbide.work/graphql/explorer), expand
**Headers**, and paste the following JSON with your actual key:

```json theme={null}
{
  "Authorization": "Bearer carbide_YOUR_API_KEY"
}
```

Then run the example on the [explorer guide](https://docs.carbide.work/explorer.md), or browse the public
queries and types in the GraphQL API reference.

## Expiration and revocation

Expired or revoked keys no longer authenticate. To revoke a key, return to
[API keys](https://app.carbide.work/settings/organization/api#api-keys), open its
actions menu, and select **Revoke key**. Revocation takes effect immediately.

If a request returns `401 Unauthorized`, check that you copied the complete key,
included the `Bearer ` prefix, and that the key has not expired or been revoked.
Keep keys out of browser application code, source control, and shared examples.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.