Skip to main content
A personal API token reads your financial data with your permissions. Treat it like a password.
  • Store it as a secret. Use an environment variable, a password manager, or your platform’s secret store. Never commit it to a repository.
  • Send it only in the Authorization header. Never put a token in a URL, a query string, a spreadsheet cell shared with others, or a log line.
  • Use the narrowest access. Choose Read only unless the script records transactions.
  • Use one token per script. You can then revoke one integration without breaking the others.
  • Prefer short expiry. A 30- or 90-day token limits the damage if it leaks. Use Never expires only for an automation you monitor, and revoke it when you stop using it.
  • Revoke on any doubt. If a token may have leaked, revoke it in Settings > Connected apps right away and create a new one.
Visor stores only a one-way digest of each token secret and never shows a token after its creation.