Account tokens

An account owner or admin creates a token in Settings > API and MCP. Give it a label, choose scopes, and set an expiry between 1 and 90 days. Copy the token when it appears: SetterFlo stores only its hash and cannot show it again.

Send Authorization: Bearer sfv2_... to https://api.setterflo.app. Keep tokens out of browser code, URLs, logs and shared documents. Revoke a token in Settings if it is no longer needed.

The preview edge limits requests per token and per IP. A 429 response includes Retry-After.