Docs

API Authentication

Authenticate against the Upcron REST API and MCP server with a personal bearer token.

Every API request must include a valid token in the Authorization header. Tokens are created in the dashboard, belong to your user account, and are never shown again after creation.

Creating a token

1

Open API Tokens

Go to Settings → API tokens in the dashboard. The same page also manages the token used by the MCP server.

2

Create the token

Enter a descriptive name (e.g. ci-deploy) and click Create Token.

3

Copy it immediately

The full token is displayed once, right after creation, with a copy button. Upcron only stores a secure hash — if you lose it, create a new token and revoke the old one.

Using the token

Send the token in the Authorization header using the Bearer scheme:

curl "https://api.upcron.io/projects" \
  -H "Authorization: Bearer YOUR_TOKEN"

The token has no expiration date by default. Keep it safe: store it in a secret manager or environment variable, never commit it to a repository, and rotate it if it may have been exposed.

Access and permissions

  • Tokens are account-scoped: API operations run with your organization and project memberships.
  • A request for an organization or project you do not belong to returns 403 Unauthorized access.
  • Create one token per purpose (CI, script, assistant) so a single purpose can be revoked independently.

Revoking a token

Delete the token from the same API Tokens page. Revocation is immediate: services using the token lose access on the next request.

Troubleshooting

API returns 401 Unauthorized
  • Check that the token exists and has not been revoked
  • Verify the header uses the Bearer scheme: Authorization: Bearer TOKEN
  • Make sure the token has no surrounding quotes or spaces
API returns 403 Forbidden
  • The token's user does not belong to the requested organization or project
  • Sign in to the relevant organization in the dashboard or use a token created by an authorized user
Token expired or lost
  • Tokens do not expire by default
  • If the token was lost, revoke it and create a new one

See the API reference for endpoint details.