> ## Documentation Index
> Fetch the complete documentation index at: https://docs.invoca.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage API Credentials

Invoca’s self-serve API token access is OAuth-compliant. Accessing APIs using the API token enables customers to access and in some cases modify information through a third-party app or APIs without the risk of compromising security. It also ensures that secure, sensitive customer-related information is not exposed to the third-party app.

## Create an API Token

To create an API token:

1. From the Main Navigation select ‘Integrations’ on the left-side panel, and then choose ‘Manage Integrations’.

   ![../\_images/manage\_api\_credentials.png](https://mintcdn.com/invoca-5bd45748/TXXjQeNTH3lIJ7cu/images/en/2026-02-01/api_documentation/manage_api_credentials.html/manage_api_credentials.png?fit=max\&auto=format\&n=TXXjQeNTH3lIJ7cu\&q=85\&s=e95b3168a335e6a21fca229615637e1e)

2. Once you’re on the ‘Integrations’ page, locate and click on the ‘Invoca APIs’ app.

   ![../\_images/invoca\_api\_app.png](https://mintcdn.com/invoca-5bd45748/TXXjQeNTH3lIJ7cu/images/en/2026-02-01/api_documentation/manage_api_credentials.html/invoca_api_app.png?fit=max\&auto=format\&n=TXXjQeNTH3lIJ7cu\&q=85\&s=5886009d8177d829e6ef1e31df38b17f)

3. Go to the upper-right corner and click on the ‘+ New API Credential’ option.

4. Enter the Description and click Save.

Please note that it is strongly recommended to include a descriptive label that identifies the API type and its intended use.

## Using API Tokens to Access Invoca APIs

You can send the access token in a variety of ways:

* **Recommended**: As an Authorization header of your request, of format `“Authorization: <token>”`

* As a URL string parameter (for GET requests), of format `?oauth_token=<token>`

* As a key/value pair in the JSON body (for POST requests of type JSON), of format `{ “oauth_token”: “<token>”, … }`

Example using Curl to make an API call with token-based authentication:

```sh theme={null}
curl -X POST -H "Accept: application/json" -H "Content-Type: application/json" -H "Authorization: YbcFHZ38FNfptfZMB0RZ6dk9dOJCaCfU" 'https://\<vanity\>.invoca.net/api/2022-08-01/advertisers/1111.json'
```

### API Guidelines

* Users should generate their own API tokens. Tokens should be treated like passwords and not be emailed or transmitted over other insecure mediums, nor should they be stored in a customer’s source code repository.

* As a network user, you should not generate a token on behalf of Advertisers or Publishers as tokens inherit the privileges of the user generating it.

* Invoca does not use OAuth refresh tokens.


## Related topics

- [Calls In Progress API](https://docs.invoca.com/developers/2026-02-01/api_documentation/calls_in_progress_api/index.md)
- [Transcripts](https://docs.invoca.com/developers/2026-02-01/api_documentation/call_api/transcript_api.md)
- [Transcript Analysis](https://docs.invoca.com/developers/2026-02-01/api_documentation/call_api/transcript_analysis_api.md)
- [Advertiser / Merchant](https://docs.invoca.com/developers/2026-02-01/api_documentation/transactions_api/advertiser_user.md)
- [Publisher / Affiliate](https://docs.invoca.com/developers/2026-02-01/api_documentation/transactions_api/affiliate_user.md)