Skip to main content
The Laravel Cloud API uses token-based authentication. You can generate an API token from your Laravel Cloud organization settings. Once you have your token, include it in the Authorization header of your API requests as follows:

​
Managing API tokens

You can manage your API tokens from your Laravel Cloud organization settings. Navigate to the API tokens section to create, view, and revoke your tokens. API Tokens management interface in Laravel Cloud settings

​
Create an API token

To create a new API token, follow these steps:
  1. Navigate to your Laravel Cloud organization settings
  2. Click on the “API tokens” section in the sidebar
  3. Click the “Create API Token” button
  4. Enter a descriptive name for your token to help you identify its purpose
  5. Select an expiration period for the token
  6. Click “Create” to generate your new API token
Make sure to copy your API token immediately after creation, as it will only be displayed once for security reasons. Store it securely and never share it publicly.

​
Revoke an API token

To revoke an API token that you no longer need or that may have been compromised, follow these steps:
  1. Navigate to your Laravel Cloud organization settings
  2. Click on the “API tokens” section in the sidebar
  3. Find the API token you want to revoke in the list
  4. Click the “Revoke” button next to the token
  5. Confirm your password when prompted
  6. Click “Revoke API token” to permanently delete the token
Once an API token is revoked, it cannot be restored. Any applications using this token will immediately lose access to the API. Make sure to update your applications with a new token before revoking the old one if you need continued access.

​
API token expiration

API tokens have configurable expiration periods to help maintain security. When creating a new token, you can choose from the following expiration options:
  • 1 month: recommended for short-term projects or testing
  • 6 months: a good balance between security and convenience
  • 1 year: suitable for long-term integrations
Once a token expires, it will no longer be valid for API requests and you’ll need to generate a new one. Make sure to update your applications with the new token before the old one expires.

​
Scoping API tokens

By default, an API token has full access to your organization and can interact with every endpoint, application, and environment. To follow the principle of least privilege, you can scope a token down so it only has the access it needs. Scoping is optional, and you configure it when you create a token. Laravel Cloud provides two independent controls for scoping a token:
  • Permissions limit which API endpoints the token can access.
  • Resource scoping limits which applications and environments the token can interact with.
You can apply either control on its own or combine them. A token’s scope is separate from user roles and permissions. A token does not inherit or mirror the access of the user who created it, so you must define its scope explicitly.

​
Permissions

Permissions determine which API endpoints a token can call. When you assign permissions, the token can perform only the actions you select, and Cloud rejects requests to any other endpoint. For example, you might grant a token permission to view deployments and trigger new ones while withholding the ability to manage environment variables or delete resources. This lets you issue a token for a continuous integration pipeline that can deploy your application without exposing your secrets.

​
Resource scoping

Resource scoping determines which applications and environments a token can interact with. When you scope a token to specific resources, Cloud rejects requests to any application or environment outside that scope. Resource scoping and permissions work together. For example, you can create a token that has permission to trigger deployments and is scoped to only your staging environment, so the token can deploy to staging but never to production.
Create a separate, tightly scoped token for each integration or automation rather than reusing one broadly scoped token. If a token is ever compromised, it can reach only the endpoints and resources you granted, and you can revoke it without disrupting your other integrations.