> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visorfinance.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Keep your personal API tokens safe.

A personal API token reads your financial data with your permissions. Treat it like a password.

* **Store it as a secret.** Use an environment variable, a password manager, or your platform's secret store. Never commit it to a repository.
* **Send it only in the `Authorization` header.** Never put a token in a URL, a query string, a spreadsheet cell shared with others, or a log line.
* **Use the narrowest access.** Choose **Read only** unless the script records transactions.
* **Use one token per script.** You can then revoke one integration without breaking the others.
* **Prefer short expiry.** A 30- or 90-day token limits the damage if it leaks. Use **Never expires** only for an automation you monitor, and revoke it when you stop using it.
* **Revoke on any doubt.** If a token may have leaked, revoke it in [Settings > Connected apps](https://dashboard.visorfinance.app/settings/connected_apps) right away and create a new one.

Visor stores only a one-way digest of each token secret and never shows a token after its creation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.