Personal Access Tokens

Taskade provides two authentication methods to protect your API interactions.

Overview

Personal Access Tokens are unique strings that authorize access to the Taskade API. Use them when a full OAuth 2.0 flow is not necessary.

Get and Use a Personal Access Token

1. Generate a Token:
   • Go to https://www.taskade.com/settings/api.
   • Scroll to Personal Access Tokens.
   • Follow the on-screen instructions to create your personal access token.
2. Use the Token in API Requests:

   • Include the token in the Authorization header of each API request:

     Makefile

     Copy

     Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN
     

3. Protect the Token: Treat personal access tokens like passwords. Anyone with the token can access the API on your behalf.
4. If you think that a token is compromised, revoke it and create a new token immediately.

Limits

• A token starts with the prefix tskdp_. Taskade shows the value once, at creation.
• Your account email must be verified. An unverified account gets 403 with code: "FORBIDDEN".
• You can hold 5 tokens per account. A sixth request returns 403 with the message Cannot create more than 5 personal access tokens.
• A personal access token carries no scopes. It grants everything the owning account can reach.

The same token authenticates REST API v1, Action API v2, the local @taskade/mcp-server, and the hosted MCP endpoint. See Authentication.