> ## Documentation Index > Fetch the complete documentation index at: https://docs.ocoya.com/llms.txt > Use this file to discover all available pages before exploring further. # API tokens > Create a token for the Ocoya API, see what it can reach, and revoke it when you're done. An API token lets your own code talk to Ocoya. Find them under **Settings → API**. This page covers managing tokens. For how to actually call the API — the base URL, the header, the endpoints — see the [REST API documentation](/welcome). Ocoya API settings showing an API usage chart with 1H, 1D and 30D ranges, and an API tokens section with a Create token button and one token listed with its masked value and creation date ## Create a token Select **Create token** and give it a name. The name is only for you — it's there so you can tell tokens apart later and revoke the right one. Name tokens after where they're used, not what they do. *Zapier*, *staging server*, *reporting script* tells you what breaks when you revoke it. *API key 2* doesn't. Copy the token as soon as it's created and store it somewhere safe. Ocoya shows only the first and last few characters afterwards. ## What a token can reach **Each token can access every brand owned by this account.** There's no way to scope a token to a single brand — the token list shows *All brands* against each one. That matters if you were planning to give a client's developer a token for their brand only. You can't. They'd be able to reach every brand you own. ## Revoke a token The **⋯** menu on any token offers **Delete token**. Deletion is immediate and permanent — anything using that token starts failing straight away, so make sure you know what's using it first. That's what the names are for. There's no way to rotate a token in place. To replace one: create the new token, move your integration across, then delete the old one. ## Watching usage The **API usage** chart shows authenticated requests for the current brand, over the last hour, day or 30 days. It's the quickest way to confirm an integration is actually calling Ocoya, or to spot one calling far more than you expected. Ocoya allows **60 requests per minute** per key, and returns `429 Too Many Requests` beyond that. The full detail, including the rate-limit headers, is in [Rate limits](/fundamentals/rate-limits). ## Related Authentication, endpoints and examples. Using Ocoya from Claude, ChatGPT or your editor instead.