# API tokens & service accounts

An API token lets a program authenticate to Koo — the [CLI](/docs/developers/cli), the SDKs, or direct calls to the [REST API](/docs/developers/api). Each token is a **service account**: a machine identity with a name and a role, confined to a single account.

## Create a token

Open the account's **Tokens** page in the console and create a token with a name and a role. Koo shows the plaintext token — a bearer credential starting `kc_…` — **once**, at creation. Copy it then; afterwards the page shows only a masked prefix, and Koo cannot show the full value again. If you lose a token, revoke it and create a new one.

## Roles

A token holds one role, chosen when you create it:

- 
-

A token acts with exactly that role's permissions (see [Teams & roles](/docs/collaboration/teams-and-roles)), and only within the account it was created in — it can never act in another account, and it can never manage members, plan, or billing.

## Use a token

Send the token as a bearer credential on every request to the [Koo API](/api/accounts):

```text
Authorization: Bearer kc_…
```

The [CLI](/docs/developers/cli) reads the same token from the `KOO_TOKEN` environment variable, so a single credential covers your terminal, your CI pipeline, and your own scripts. The [Node SDK](/docs/developers/sdk-node) (Coming soon), [Go SDK](/docs/developers/sdk-go) (Coming soon), and [MCP server](/docs/developers/mcp-server) (Coming soon) authenticate with it too.

## Manage tokens

- 
- 
-

> **Warning:**
>
> Treat tokens like passwords. Keep them in your CI provider's secret store, never in source control, and create a separate token per system so any one can be revoked without disrupting the others.