API tokens: how to create, scope and revoke them

Create a PressaGen API token in your dashboard, choose what it can do and when it expires, and revoke it when it leaks or you stop using it.

Updated October 20, 2026

An API token lets an AI tool or your own script sign in to PressaGen as you. You create it under API and MCP on your dashboard, it can do only what you tick, and it stops working when it expires or you revoke it.

Create a token

Near the bottom of your dashboard, between My images and Your account, open API and MCP.
Under Token name, say which tool it is for, such as Claude Code on my laptop, in up to 40 characters.
Under What it can do, tick what this token may do, as the next section explains.
Under Expires after, choose 30 days, 90 days or 1 year. 1 year is chosen to begin with.
Choose Create token. When Copy your new token appears, choose Copy, keep the token somewhere safe, then choose Done.

A token starts with pg_ and is shown only this once. PressaGen keeps only its SHA-256 hash, so no one can see the token again afterwards; if you did not save it, revoke it and create another.

Each token in the list shows its name, its first 11 characters, what it can do, the date it was Last used and when it expires, so you can tell your tokens apart. An account can hold up to 10 working tokens at a time.

What a token can do

See your pages, images and plan: every token has this, and it cannot be unticked.
Create and edit pages, and upload images: lets the token add pages, change their content and upload images.
Publish pages: lets the token put pages live.

For now AI tools can only read, and tools for editing and publishing will come later. If you only want an AI to read your pages, leave the last two unticked: the less a token can do, the less a leaked one can be used for.

When a token expires

No token lasts forever. Its expiry date shows in the list, and once that date passes it is marked Expired and stops working. To keep going, create a new token and put it in your tool.

Revoke a token

In the list under API and MCP, find the token and choose Revoke.
Confirm in the Revoke token dialog.

A revoked token stops working at once: the next request from any tool using it is refused, and this cannot be undone. Sign out everywhere under Signed-in devices signs out browsers and devices only and leaves tokens working, so revoke a token to stop it.

Limits and records

After 20 failed attempts with a wrong or dead token from one network address within a minute, that address is refused for the rest of the minute; through MCP, each account can make up to 120 requests a minute.
Every time an AI tool calls a tool, PressaGen records which token, which tool, which page or template, whether it worked and how long it took, and keeps that record for 90 days. The Privacy Policy has the details.

Questions

What should I do if my token leaks?

Choose Revoke under API and MCP right away, and it stops working at once. Then create a new token and put it in your tools. Until you revoke it, whoever has it can do only what it allows, so ticking only what you need limits the damage.

One token works in as many tools as you put it in, but give each tool its own and name it after the tool. Then you can revoke one without breaking the others, and Last used shows which tool is using which token.