Scripts, CI pipelines and other tools use the veldhost API with a personal API token. The token acts as you, but only on the sites and with the scopes you give it. It can never do more than your role on the account allows.
Connecting an AI assistant such as Claude, ChatGPT or Cursor? You do not need a token for that. The assistant signs in as you: see Connect your AI assistant.
Create a token
- Open Settings → Developer → API & MCP and choose Create token.
- Give it a Name that says where it is used, such as
CI pipeline. - Choose when it Expires. Every token expires. There is no "never", so a forgotten token stops working on its own.
- Under Sites this token can reach, tick the sites the script works on. Leave them all unticked and the token reaches every site you can access.
- Under What it may do, tick the scopes it needs. read is always included. The form offers only the scopes your role lets you grant, and data is never implied by the others. Scopes and permissions explains each one.
- Choose Create token. If you have not entered your password recently, you are asked for it first.
Your new token appears at the top of the page, starting with mpc_. Copy it now, because it is not shown again. We keep only a fingerprint of it, so we cannot show it to you later either.
Tip: Give each script or pipeline its own token with the fewest scopes it needs. If one leaks, you revoke that one and nothing else stops.
Use it
Send the token in the Authorization header of every request. API_BASE stands for https://manage.veldhost.eu/api/v1:
curl -H "Authorization: Bearer mpc_YOUR_TOKEN" API_BASE/sites
The Connect panel on the same page shows the API base address and the OpenAPI document, with copy buttons. Store the token as a secret in your CI system or password manager. Never put it in a Git repository or in front-end code.
Keep track of your tokens
The Tokens table lists each token with its last four characters, its scopes, the sites it reaches, when and from which IP address it was Last used, and when it Expires. The Expiring in 7 days tile counts the tokens that are about to stop. When some have expired, tick Show expired above the table to list them too.
A token marked full access was created before scopes existed and can do everything you can. Replace it with a token that has only the scopes it needs.
Replace a token (regenerate)
Use this when a token is about to expire, or you think it has leaked.
Caution: The old token stops working the moment you regenerate it. Anything still using it fails until you give it the new one.
- Open the token's row menu and choose Regenerate.
- Confirm with Regenerate token. You may be asked for your password.
You get a new token with the same name, sites, scopes and lifetime. Copy it now, because it is shown only once.
Revoke a token
Open the token's row menu, choose Revoke, then Revoke token. It stops working straight away, and any integration using it stops too.
When a token stops working
A request with a bad token gets 401 unauthenticated. A token stops working when:
- it has expired or been revoked;
- you reset your password (resetting it removes all your tokens);
- your user is locked.
If your account requires two-factor authentication and you have not set it up, requests get 403 two_factor_required until you do. See Two-factor and passkeys.
If your role changes, your tokens follow it: within a minute, a token can do only what your new role allows.