Every request to the Voiceflow API carries a personal access token. The
same token authenticates the REST API, the vf CLI, and optionally the MCP
server, so there is one credential to create and one to rotate.
Create a token
Open Settings → Access tokens and choose Create personal access token. Give it a name you will recognise later and pick how long it should last.
The token is shown once, at creation. After you close the dialog only a masked version is visible, so store it somewhere durable before you leave the page.
A token looks like this, and always begins with vfp_:
Expiry
Tokens expire. You choose the lifetime when you create one:
There is no non-expiring option, so any long-running integration needs a calendar reminder to issue a replacement before the current token lapses.
What a token can reach
A personal access token acts as you. It carries the same access your own account has, across every workspace you belong to, and cannot be narrowed to a single workspace or project.
Two consequences worth planning around:
- Treat a token like a password. Anyone holding it can do anything you can do.
- Tokens can only be created through the dashboard, so a person has to issue and rotate the one your automation uses.
Send the token
Pass it in the Authorization header as a Bearer token:
Target a project and environment
Most endpoints act on one project, and many act on one environment inside it. Both are query parameters rather than path segments:
Find projectID in Settings → General under Metadata.
environmentAlias names an environment
in that project. New projects start with a single environment called main.
Passing an alias the project does not have returns:
List the aliases a project actually has with List environments.
Revoke a token
Delete it from Settings → Access tokens. Revocation takes effect immediately, so anything using that token stops working the moment you remove it. Issue and deploy the replacement first.