> ## Documentation Index
> Fetch the complete documentation index at: https://docs.carbide.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Get an API token

> Generate an organization API key and use Carbide’s business API.

Use an API key as your bearer token when connecting to Carbide's GraphQL API.
Each key belongs to one organization, so you don't need to send an organization
ID with your requests.

## Generate a key

You must be an active **owner** or **admin** of the organization to create or
manage API keys.

**1. Open API settings**

Sign in to [Carbide](https://app.carbide.work), select your organization, and
open **Settings → Organization → API**.

[Go to API keys](https://app.carbide.work/settings/organization/api#api-keys).

**2. Generate an API key**

In **API keys**, select **Generate API key**. Give the key a name that
identifies its purpose, then choose an expiration. The default is 90 days.

Leave the MCP permission options unchecked when following this GraphQL
quickstart; those options control access through AI clients.

**3. Copy your token**

Copy the complete key, including its `carbide_` prefix, and store it securely.

> [!WARNING]
>
> Carbide shows the key only once. After you close the dialog, you cannot
> retrieve it again. If you lose it, generate a replacement and revoke the
> old key.

## Authenticate requests

Send your key in the `Authorization` header:

```http theme={null}
Authorization: Bearer carbide_YOUR_API_KEY
```

GraphQL requests use `POST https://app.carbide.work/graphql` with a JSON body.
For example, set `CARBIDE_API_KEY` to your key in your local environment and run:

```bash theme={null}
curl https://app.carbide.work/graphql \
  --header "Authorization: Bearer ${CARBIDE_API_KEY}" \
  --header "Content-Type: application/json" \
  --data '{"query":"query { listRequests(first: 10) { count } }"}'
```

This read-only query returns the request count for the key's organization.

## Permissions

The public API supports requests, jobs, customers, core scheduling, and business
settings. A key uses its creator's **current role** in its fixed organization.
Members can perform the business actions their role allows; settings that require
an owner or admin keep that requirement. Role changes apply to existing keys.

**GraphQL keys can write.** The MCP permission checkboxes apply only to AI clients;
leaving them unchecked does not make GraphQL access read-only. No additional
write flag is required. Requests still enforce product eligibility, record
ownership, validation, and organization boundaries.

Provider-specific imports and sync controls, account security, integration setup,
platform administration, the advanced scheduling planner, and subscriptions are
not exposed through this API. Customer booking uses a separate booking-token API.

## Use the GraphQL explorer

Open the [GraphQL explorer](https://app.carbide.work/graphql/explorer), expand
**Headers**, and paste the following JSON with your actual key:

```json theme={null}
{
  "Authorization": "Bearer carbide_YOUR_API_KEY"
}
```

Then run the example on the [explorer guide](https://docs.carbide.work/explorer.md), or browse the public
queries and types in the GraphQL API reference.

## Expiration and revocation

Expired or revoked keys no longer authenticate. To revoke a key, return to
[API keys](https://app.carbide.work/settings/organization/api#api-keys), open its
actions menu, and select **Revoke key**. Revocation takes effect immediately.

If a request returns `401 Unauthorized`, check that you copied the complete key,
included the `Bearer ` prefix, and that the key has not expired or been revoked.
Keep keys out of browser application code, source control, and shared examples.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.