> ## Documentation Index
> Fetch the complete documentation index at: https://developers.bottari.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokens

> The integration token format, where to manage it, and how to replace it.

API requests authenticate with an integration token. Each integration has one token, labeled **Secret** in the app.

```http theme={null}
Authorization: Bearer bti_...
Bottari-Version: 2026-03-11
```

## Token format

A token is `bti_` followed by 43 characters: letters, digits, `_`, and `-`. App login tokens can't call this API, and integration tokens can't call any other Bottari feature.

## Manage a token

Only team owners can see tokens. Open the integration under **Settings → API integrations** and use the **Secret** row.

| Button | What it does |
| - | - |
| **Show**, **Copy** | Shows or copies the current token. You can view it any number of times, and each view is recorded in the audit log. |
| **Regenerate** | Creates a new token. The current token stops working immediately. |

**Delete integration** rejects requests with that token immediately and removes all its connections. Rows the deleted integration's bot wrote keep the bot's ID.

Creating an integration, regenerating a token, and creating a webhook subscription share a limit of 10 per hour per team. A team can have up to 25 integrations.

## Authentication errors

| Response | Message | Cause |
| - | - | - |
| 401 `unauthorized` | `Authorization header must use the format "Bearer <token>".` | The header is missing or malformed. |
| 401 `unauthorized` | `API token is invalid.` | The token is wrong or was regenerated, or the integration was deleted. `additional_data.reason` is `token_invalid`. |
| 400 `validation_error` | `Bottari-Version "..." is not supported by this server...` | The version isn't `2026-03-11`. |

The server checks the path, then JSON, authentication, version, and body. An unknown path returns 400 `invalid_request_url` before the token is read.

## Integration bot

Each integration has a bot user. The `id` from `GET /v1/users/me` is that bot's ID.

* It appears in `created_by` on rows the integration creates and `last_edited_by` on rows it updates.
* It appears in webhook `authors` as `{ "id": "<bot id>", "type": "bot" }`. Use it to skip your own changes.
* The integration stays when the person who created it or connected a database leaves the team.

## Keep tokens safe

* Store tokens in environment variables or a secret manager. Never put them in code sent to a browser.
* Create a separate integration for each job, turn on only the capabilities it needs, and connect only the databases it needs.
* If a token leaks, select **Regenerate** to block the old one immediately.
* Integration reads and writes and token views are recorded in the team audit log.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.