Use API tokens

Your Bredbox library shouldn’t end at the app’s UI. API tokens let your scripts, services, and tools read and write your library through the REST API.

The full API reference — every endpoint, with schemas — lives at api.bredbox.app/v2/docs. It’s also linked from Settings → REST API Docs.

Before you start

You need the Pro plan, which includes developer features. If you are not sure which plan you have, check Manage your plan and data.

Create a token

1. Open Settings → Tokens.
2. Create a new token.
3. Give it a name that explains what it is for.
4. Choose the scopes it needs.
5. Set an expiration date if you do not want it to last forever.
6. Create the token and copy it somewhere safe.

Make your first request

The API lives at https://api.bredbox.app/v2, and tokens go in the Authorization header:

curl -H "Authorization: Bearer $BREDBOX_TOKEN" \
  https://api.bredbox.app/v2/saves

Creating a save is one POST away:

curl -X POST \
  -H "Authorization: Bearer $BREDBOX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/article"}' \
  https://api.bredbox.app/v2/saves

Choose the smallest scope you need

Scopes follow an area:action pattern — saves:read, saves:write, saves:delete, and the same trio for collections, plus tags:read, imports:*, exports:*, webhooks:*, tokens:*, authorizations:*, and user:*. The token creation screen lists every scope with a description.

Treat API tokens like passwords:

• Create one token per script or integration.
• Use the narrowest scope that still works — a read-only dashboard needs saves:read, nothing more.
• Add an expiration date for temporary automation.
• Revoke tokens you no longer use.

Regenerate or revoke a token

Go back to Settings → Tokens when you need to:

• Replace a token that was exposed
• Rotate credentials for routine security
• Disable a token you no longer trust

Important safety rule

You are shown the full token value only once, when it is created. Save it immediately in your password manager or secrets system.

Manage connected applications

Apps that access your account through OAuth — the n8n community node, MCP clients, and other integrations — appear in Settings → Applications, where you can review and disconnect them at any time. (If you automate with n8n, search its community nodes for Bredbox — it covers the public API and signs in with your Bredbox account, no token pasting needed.)

When a token stops working

Check these common causes:

1. The token expired.
2. The token was revoked or regenerated.
3. The token does not have the scope your integration needs — the API answers with an insufficient_scope error naming the missing scope.
4. Your account is in read-only mode or your plan no longer includes API access.

Related guides

• Use webhooks
• Connect AI assistants
• Manage your plan and data