Skip to main content
Every request to the Voiceflow API carries a personal access token. The same token authenticates the REST API, the vf CLI, and optionally the MCP server, so there is one credential to create and one to rotate.

​
Create a token

Open Settings → Access tokens and choose Create personal access token. Give it a name you will recognise later and pick how long it should last.
The token is shown once, at creation. After you close the dialog only a masked version is visible, so store it somewhere durable before you leave the page.
A token looks like this, and always begins with vfp_:

​
Expiry

Tokens expire. You choose the lifetime when you create one: There is no non-expiring option, so any long-running integration needs a calendar reminder to issue a replacement before the current token lapses.

​
What a token can reach

A personal access token acts as you. It carries the same access your own account has, across every workspace you belong to, and cannot be narrowed to a single workspace or project. Two consequences worth planning around:
  • Treat a token like a password. Anyone holding it can do anything you can do.
  • Tokens can only be created through the dashboard, so a person has to issue and rotate the one your automation uses.

​
Send the token

Pass it in the Authorization header as a Bearer token:

​
Target a project and environment

Most endpoints act on one project, and many act on one environment inside it. Both are query parameters rather than path segments:
Find projectID in Settings → General under Metadata. environmentAlias names an environment in that project. New projects start with a single environment called main. Passing an alias the project does not have returns:
List the aliases a project actually has with List environments.

​
Revoke a token

Delete it from Settings → Access tokens. Revocation takes effect immediately, so anything using that token stops working the moment you remove it. Issue and deploy the replacement first.