A personal access token (PAT) lets a script, spreadsheet or small internal tool talk to the ThirdSectorBee API on your behalf. It’s best for your own tooling. For an integration other organisations will use, use the OAuth flow instead: see API authentication.

A token is a key to your beehive’s data. Treat it like a password: don’t email it, paste it into chat, or commit it to a code repository.

Before you start

  • You need account:api:access. Without it, the Developers tab doesn’t appear in Settings.
  • A token can only carry permissions you hold yourself in the current beehive. Ask an administrator if you need more.
  • Tokens are personal. You see and revoke only your own, and each token works only in the beehive you created it in.

Create a token

  1. Open the account menu, choose Settings, then the Developers tab.
  2. Under Create API Token, enter a Name that says what the token is for, such as Monthly finance export.
  3. Under Expiry, choose 7 days, 30 days or 90 days. Choose the shortest that will do the job.
  4. Under Permissions, tick only the permissions the tool needs. Each option shows what it allows.
  5. Choose Create Token.

Copy the token

ThirdSectorBee shows Copy your token now with the token in full. It begins tsb_pat_.

Copy it straight into the tool or a password manager before you go on. This token will not be shown again. If you lose it, revoke it and create a new one.

Choose Done to clear the form. The token now appears under Active Tokens with its name, permissions, creation date and expiry date.

To use it, send it in the Authorization: Bearer header along with your Beehive ID, which you’ll find on Settings → User. See API authentication and the API quickstart.

Revoke a token

Revoke a token as soon as it’s no longer needed, or if you think it’s been exposed.

Check you’re revoking the right one before you choose. Revoke takes effect straight away and doesn’t ask you to confirm. Any tool using the token stops working, and it can’t be restored.

  1. On the Developers tab, find the token under Active Tokens.
  2. Choose Revoke on its row.

The token disappears from the list.

If something goes wrong

  • “Name is required.” or “Select at least one permission.” Fill in the missing part and choose Create Token again.
  • “Failed to create token. Please try again.” The token wasn’t created. This can happen if a permission you ticked has been removed from you since the page loaded; reload the page and try again.
  • “No permissions available.” You hold no permissions in this beehive that a token could carry.
  • “Access denied” on the Developers tab: you no longer hold account:api:access.