Send a Bearer token on protected routes:
Project API Tokens
For account-scoped automation, use Agent Tokens. A master
key provisions child credentials without being used for project data requests.
Start under Account users → Add Agent / Setup Token. Send the one-use Setup
Token to the agent privately; it must activate and securely store the returned
master immediately, before other work. Setup expires five minutes after generation.
Project API Tokens are the public integration credential for project data API calls.
Project API Tokens can read and modify application data inside their project. Store them like database passwords.
Creating and rotating tokens
The usual path is the ZangTable admin panel: log in at https://zangtable.com, open a project, and create a token from the project’s API Tokens area.
Server-side token-management endpoints also exist for trusted automation. Use them only from a backend that already has a project credential allowed to manage API tokens. Creating a new Project API Token adds another active token; existing Project API Tokens keep working until you explicitly revoke them.
Error behavior
- Public project endpoints can return HTTP 404 with an empty body when the Bearer token is missing or unusable. Check the HTTP status before parsing JSON.
- Token creation through the API requires an existing project credential that is allowed to manage API tokens.
Token management endpoints