To use the Typeform Create, Responses, and Webhooks APIs, you need to pass your personal access token in the Authorization header of your requests. Our Embed SDK doesn't require an access token.
Access tokens are long strings of random characters that look something like this:
tfp_943af478d3ff3d4d760020c11af102b79c440513. Your access token is unique to you. We use it to identify you and make sure that only you can access your typeforms and results.
To use our APIs, you need a Typeform account — if you don't have one, head to www.typeform.com to register before you get started here.
NOTE: Anyone with your personal access token can read, update, and delete your typeforms and data, so keep access tokens and your
client_secret codes safe! Also, don't commit to source control with your access token,
client_secret in your code — use a placeholder like
To use the Create and Responses APIs or set up a webhook (for example, with cURL or Postman), you need a personal access token. You must pass a valid personal access token in the Authorization header of every request.
You can generate personal access tokens in your Typeform account. Here's how:
NOTE: Typeform is a Github secret scanning partner. If you're using Github secret scanning, any Typeform personal access token added to a repository will be detected by Github. Once detected, it will automatically be disabled and you'll receive an email notification about the incident.
Now that you have your personal access token, you can start making requests. Check out this explanation of the JSON response from our Responses API to see how a typeform response is structured, or head straight to one of our APIs — they're listed in the left menu. You can also explore creating an app that integrates with Typeform's APIs.
If you're looking for inspiration, find out what other open-source developers are doing on our Community projects page.
In case there has been an unauthorized access to your personal access token, it has been leaked, or disclosed by mistake you should regenerate it.
You can regenerate personal access tokens in your Typeform account. Here's how:
Remember that, after regenerating a personal acccess token, you will have to update the token value everywhere you are using it.
Once you no longer need a personal access token you should delete it.
You can delete personal access tokens in your Typeform account. Here's how: