---
updatedAt: 2026-04-01T21:54:11.000Z
agentTools:
  projectIndex: https://docs.manifestcyber.com/llms.txt
---

# Managing API Tokens

Manifest's APIs allow you to easily bring all of Manifest's functionality to your automated workflows. This ability is limited to team members with Admin or Member roles. 

*Notice as of August 11, 2025: Manifest is transitioning to user level tokens. Organization level tokens will be fully deprecated after the last org level token expires for users.*

## Creating a New API Token

1. Go to **Settings** -> **Account** -> **[API Tokens](https://app.manifestcyber.com/settings/account/api-tokens)**
2. Click the "**Create new token**" button in the top right.
3. Fill in your token details:
   * Token name (\*Please note that this must be a unique name)
   * Description (*Optional*)
   * Scope selection
   * Expiration length.
     * All Manifest API Tokens expire within 1 year. We *highly* recommend setting the expiration time to **<3 months** for security reasons. Reminders will be sent to your email as the expiration date approaches.
4. Click "**Create**" to generate your token and make sure you to save it immediately.

> ❗️ Copy your API token immediately and store it securely - you won't be able to see it again after leaving this screen.

<br />

***

<br />

## Using Your API Token

Once you've created your token, you can use it to:

* Authenticate the [Manifest CLI](https://docs.manifestcyber.com/docs/using-the-cli)
* Set up [Github Actions](https://docs.manifestcyber.com/docs/connecting-to-github)
* Configure automated SBOM and AIBOM workflows using our APIs: <https://api-docs.manifestcyber.com/>

For security reasons, we recommend that each integration should use a unique API token so you can track and manage access individually.

***

<br />

## FAQs

* **What happens to my tokens if my role changes?** If a role is downgraded in permissions, for security reasons, the user's tokens will be deleted.
* **How do I upload an SBOM to a specific sub-organization?**

  1. Generate a unique API token for each sub-organization you have access to.
  2. Use that token when making requests for the corresponding sub-organization.

  👉 Using tokens this way removes the need to pass an (sub)organization ID as a parameter.