Where to get one
Everything that talks to DemandBird from outside the app โ the REST API, the MCP server, the Chrome extension โ authenticates with an API token.
Tokens live at app.demandbird.com/api_tokens. In the app: Settings โ Developer Access.
Click Create an API Token, name it after the thing that will use it, choose what it may do, and save. The token is shown on the page that follows, with a copy button.
You also need your Account ID
Most integrations want two values, not one. The Account ID is at the top of the same page, next to a copy button. It looks like:
acct_9ZgKq6LEmw6rLtpw0B3DjPdx
The token is scoped to that account already โ it cannot act on any other account you belong to, even if you belong to several. The ID is there because some clients need to name the account explicitly in a header or a config file.
Choosing what a token can do
When you create a token you get the list of things you can do, all checked. Uncheck anything this token has no business doing.
A token can never do more than you can. If your own seat cannot approve posts, no token you create can approve posts, no matter what you check. And if your permissions are narrowed later, every token you made narrows with them.
Some sensible shapes:
- A read-only reporting script โ uncheck everything. A token with no permissions can still identify itself and read, which is all a dashboard needs.
- An MCP client you draft with โ content creation, yes. Billing and member management, no.
- A publishing automation โ creation and publishing, nothing else.
Make one token per integration rather than reusing one everywhere. When you need to revoke it, you want to break one thing.
Using it
Send it as a bearer token:
GET /api/v1/me.json
Accept: application/json
Authorization: Bearer db_live_xxxxxxxxxxxx
Or:
curl https://app.demandbird.com/api/v1/me.json \
-H "Accept: application/json" \
-H "Authorization: Bearer db_live_xxxxxxxxxxxx"
/api/v1/me.json is the endpoint to test with. It tells you which account and which
permissions the token resolved to, and nothing it returns is destructive.
The full endpoint list is in the API reference. The MCP server page has the config-file form.
Keeping it secret
A token is a password. Anyone holding it can act as you, within its permissions.
- Put it in your shell's keychain, a secrets manager, or an environment variable โ not in a repository, a shared doc, or a chat message.
- Do not paste it into a support ticket. We never need it; we can look at your account from our side.
- The app blurs the token on screen until you click it, so a screen share or a screenshot of the page does not leak it.
If a token has been exposed, revoke it. Do not try to reason about whether it was actually used.
Checking whether one is still in use
The token list shows Last used for each one. That is the way to find the tokens you made two integrations ago and forgot about.
A token that has never been used shows a dash. A token last used months ago is a liability with no upside.
Revoking
Open the token and click Revoke. It stops working immediately, everywhere. There is
no grace period and no undo โ anything using it starts getting 401 on its next
request.
Revoking one token does not affect any other.
Older tokens
A token created before tokens were account-scoped had access to every account you belong to. If you have one of those, its page says so.
They still work. But if you belong to more than one account, revoke it and make a fresh one โ the replacement is pinned to a single account and carries an explicit permission list, and neither of those is something the old shape can be upgraded into.
Availability
The REST API and the MCP server are on Business and Agency. You can create
tokens on any plan, and the Chrome extension uses one on
every plan, but the API and MCP endpoints themselves answer 403 below Business.
If you were an early user with API access before it was a paid feature, that access was preserved. If you think it was not, tell us.