# API tokens

> Create and revoke the tokens that let a script or Pulumi program manage your school site.

**Settings › API** is for owners and admins. A token lets a script read your school's site configuration, or replace it, through the Aula management API at `/api/v1`. The OpenAPI document is served at `/api/v1/openapi.json`.

## Create a token [#create-a-token]

Enter a name that says what the token is for, choose a scope and, if you want one, an expiry in days. Choose **Create token**.

- **Read the site**: can read the site configuration and the custom domain.
- **Read and replace the site**: can also replace the site configuration.

The secret starts with `aula_` and is shown once. Copy it before leaving the page: Aula keeps only a fingerprint and cannot show it again. A token works for your school only.

## Use a token [#use-a-token]

Send it as a bearer token:

```sh
curl -H "Authorization: Bearer aula_..." https://aula.sferarc.com/api/v1/site-config
```

With the Pulumi provider `@sferarc/aula-pulumi`, store it as the secret `aula:token`.

## Revoke a token [#revoke-a-token]

**Revoke** stops a token at once. It stays in the list, greyed out, so you can see when it was revoked. Revoke a token as soon as you think it has leaked, then create another.