Skip to main content
An Embedder API token authorizes HTTP API and daemon requests. Send it in:
Treat the token as an account credential. Keep it in a secret store or process environment and replace it if it is exposed.
For organization usage data, follow Get an Analytics API token and enable the required analytics:read scope.

​
Create a token in the app

Open Account, select Tokens, create a token with a name that identifies its machine or job, and copy the value into that machine’s secret store. Examples of useful names:
Do not reuse one key across unrelated machines. Separate keys let you replace one credential without interrupting every daemon.

​
Create a token through the API

The response contains the new secret in key:
Capture that value from the creation response. You cannot recover the secret later. name is required. embedder start daemon generates Embedder daemon <short-hostname> and truncates it to 32 characters.

​
Use a token with HTTP

An invalid or rejected bearer receives 401. A valid bearer can still receive 403 when the account, role, organization feature, or operation does not permit the request.

​
Use a token with the daemon

For a non-interactive host:
PowerShell:
embedder start daemon resolves authentication in this order:
  1. EMBEDDER_API_KEY
  2. A stored daemon key for the backend URL
  3. A key created from the current interactive login
  4. A pasted key
The detached child receives the selected key as EMBEDDER_API_KEY. The foreground embedder --daemon mode is stricter. It accepts the environment variable or a stored daemon key and fails if neither exists.

​
Stored daemon keys

When the CLI creates or prompts for a daemon key, it stores the key in an encrypted file below ~/.embedder. Keys are kept separate per environment so a key created for one backend is not sent to another. EMBEDDER_API_KEY always takes precedence over the stored file. Use that precedence to test a replacement before changing any saved credential.

​
EMBEDDER_API_KEY and EMBEDDER_AUTH_TOKEN

These variables serve different launch paths: Both values are sent as bearer tokens. The names describe which client path reads them. EMBEDDER_AUTH_TOKEN wins over the encrypted interactive credential file. It does not replace EMBEDDER_API_KEY in daemon mode.

​
Model-provider keys are separate

An Embedder token is not an OpenAI-compatible endpoint key, GitHub Copilot credential, ChatGPT credential, or MCP token. Using a model-provider key as EMBEDDER_API_KEY produces 401 because it was not issued by Embedder.

​
Rotate a daemon key

1

Create a replacement

Create a new key in the app or with POST /api/v1/tokens.
2

Test it

embedder status reads EMBEDDER_AUTH_TOKEN, so use the direct API request when you are testing a daemon key.
3

Restart the daemon

4

Remove the old key

Revoke the old key in the app after the replacement daemon shows connected in embedder monitor.

​
Handle authentication failures

Embedder rejected the key before the daemon connected. Confirm the key belongs to the selected environment and that --backend-url, EMBEDDER_BACKEND_URL, and EMBEDDER_API_URL point to the intended deployment.
embedder start daemon removes the rejected stored key from its resolution path and asks for a replacement. Set EMBEDDER_API_KEY to bypass the stored value.
Authentication succeeded. Check the repository mapping and any --team and --project override; queue eligibility is separate from bearer validation.
Create an Embedder token. Local model, Copilot, Codex, and MCP credentials are not interchangeable with the Embedder bearer.
Last modified on August 26, 2026