Personal access token for Typeform's APIs

To use the Typeform Create, Responses, and Webhooks APIs, you need to pass your personal access token in the Authorization header of your requests. Our Embed SDK doesn't require an access token.

Access tokens are long strings of random characters that look something like this: tfp_943af478d3ff3d4d760020c11af102b79c440513. Your access token is unique to you. We use it to identify you and make sure that only you can access your typeforms and results.

To use our APIs, you need a Typeform account — if you don't have one, head to www.typeform.com to register before you get started here.

NOTE: Anyone with your personal access token can read, update, and delete your typeforms and data, so keep access tokens and your client_id and client_secret codes safe! Also, don't commit to source control with your access token, client_id, or client_secret in your code — use a placeholder like ACCESS_TOKEN instead.

To use the Create and Responses APIs or set up a webhook (for example, with cURL or Postman), you need a personal access token. You must pass a valid personal access token in the Authorization header of every request.

You can generate personal access tokens in your Typeform account. Here's how:

1. Log in to your account at Typeform.
2. In the upper-left corner, in the drop-down menu next to your username, click Account.
3. In the left menu, click Personal tokens or here.
4. Click Generate a new token.
5. In the Token name field, type a name for the token to help you identify it.
6. Choose needed scopes (API actions this token can perform - or permissions it has). See here for more details on scopes.
7. Click Generate token.

NOTE: Typeform is a Github secret scanning partner. If you're using Github secret scanning, any Typeform personal access token added to a repository will be detected by Github. Once detected, it will automatically be disabled and you'll receive an email notification about the incident.

Now that you have your personal access token, you can start making requests. Check out this explanation of the JSON response from our Responses API to see how a typeform response is structured, or head straight to one of our APIs — they're listed in the left menu. You can also explore creating an app that integrates with Typeform's APIs.

If you're looking for inspiration, find out what other open-source developers are doing on our Community projects page.

In case there has been an unauthorized access to your personal access token, it has been leaked, or disclosed by mistake you should regenerate it.

You can regenerate personal access tokens in your Typeform account. Here's how:

1. Log in to your account at Typeform.
2. In the upper-left corner, in the drop-down menu next to your username, click Account.
3. In the left menu, click Personal tokens or here.
4. Identify the token you want to regenerate.
5. Click ..., the three dots button in the right-side of the list.
6. Click Regenerate token.

Remember that, after regenerating a personal acccess token, you will have to update the token value everywhere you are using it.

Once you no longer need a personal access token you should delete it.

You can delete personal access tokens in your Typeform account. Here's how:

1. Log in to your account at Typeform.
2. In the upper-left corner, in the drop-down menu next to your username, click Account.
3. In the left menu, click Personal tokens or here.
4. Identify the token you want to delete.
5. Click ..., the three dots button in the right-side of the list.
6. Click Delete this token.