Skip to main content
The Laravel Cloud API uses token-based authentication. You can generate an API token from your Laravel Cloud organization settings. Once you have your token, include it in the Authorization header of your API requests as follows:

​
Managing API tokens

You can manage your API tokens from your Laravel Cloud organization settings. Navigate to the API tokens section to create, view, and revoke your tokens. API Tokens management interface in Laravel Cloud settings

​
Create an API token

To create a new API token, follow these steps:
  1. Navigate to your Laravel Cloud organization settings
  2. Click API tokens in the sidebar
  3. Click the Create API Token button
  4. Enter a descriptive name for your token to help you identify its purpose
  5. Select an expiration period for the token
  6. Click Create to generate your new API token
Copy your API token immediately after you create it. For security reasons, Laravel Cloud displays the token only once. Store it securely and never share it publicly.

​
Revoke an API token

To revoke an API token that you no longer need or that may have been compromised, follow these steps:
  1. Navigate to your Laravel Cloud organization settings
  2. Click API tokens in the sidebar
  3. Find the API token you want to revoke in the list
  4. Click the Revoke button next to the token
  5. Confirm your password when prompted
  6. Click Revoke API token to permanently delete the token
You can’t restore a revoked API token. Any applications using the token immediately lose access to the API. If you need continued access, update your applications with a new token before you revoke the old one.

​
API token expiration

API tokens have configurable expiration periods to help maintain security. When creating a new token, you can choose from the following expiration options:
  • 1 month: recommended for short-term projects or testing
  • 6 months: a good balance between security and convenience
  • 1 year: suitable for long-term integrations
Once a token expires, it’s no longer valid for API requests, and you’ll need to generate a new one. Make sure to update your applications with the new token before the old one expires.

​
Scoping API tokens

By default, an API token has full access to your organization and can interact with every endpoint, application, and environment. To follow the principle of least privilege, you can scope a token down so it only has the access it needs. Scoping is optional, and you configure it when you create a token. Laravel Cloud provides two independent controls for scoping a token:
  • Permissions limit which API endpoints the token can access.
  • Resource scoping limits which applications and environments the token can interact with.
You can apply either control on its own or combine them. A token’s scope is separate from user roles and permissions. A token does not inherit or mirror the access of the user who created it, so you must define its scope explicitly.

​
Permissions

Permissions determine which API endpoints a token can call. When you assign permissions, the token can perform only the actions you select, and Cloud rejects requests to any other endpoint. For example, you might grant a token permission to view deployments and trigger new ones while withholding the ability to manage environment variables or delete resources. That combination lets you issue a token for a continuous integration pipeline that can deploy your application without exposing your secrets.

​
Resource scoping

Resource scoping determines which applications and environments a token can interact with. When you scope a token to specific resources, Cloud rejects requests to any application or environment outside that scope. Resource scoping and permissions work together. For example, you can create a token that has permission to trigger deployments and is scoped to only your staging environment, so the token can deploy to staging but never to production.
Create a separate, tightly scoped token for each integration or automation rather than reusing one broadly scoped token. If a token is ever compromised, it can reach only the endpoints and resources you granted, and you can revoke it without disrupting your other integrations.