---
title: Generate tokens and use the REST APIs
slug: feature-experimentation/api/pQfa-generate-tokens-and-use-the-rest-apis
createdAt: 2026-08-05T20:40:17.712Z
---

The Optimizely Feature Experimentation REST APIs let you interface with Optimizely programmatically to build customized integrations and workflows. For example, you can create feature flags from an automated script or build custom dashboards of experiment results.

## Integrate the REST API

:::hint{type="info"}
**Note**
Web Experimentation and Feature Experimentation share the Optimizely REST APIs, so some resources do not apply to Feature Experimentation projects. See [About the Feature Experimentation APIs](docId\:lMUQVOETwikoFzp7643EQ) for a list of available endpoints.
:::

For production, you should integrate the REST API calls directly into your application. You should use OAuth 2.0. For implementation details, see the Optimizely Web Experimentation [OAuth 2.0](docId\:QlcGFoh9mcZPQ88kdONI0) documentation.

To make the APIs easily explorable, Optimizely has also implemented [personal access tokens](docId\:pQfa5KPTbmy6crey-nsrd).

## Generate a token

To generate a personal access token in Optimizely

1. Go to **Profile > API Access** and click **Generate New Token**.
2. (Optional) If you are an [administrator](docId\:bNAxj4srKHVczBp27i1DH), you can create tokens for other collaborators on the account. Use the drop-down list to select a collaborator.
3. Enter a token name and click **Create**.
4. Copy the token.

For security purposes, when you go away from the **API Access** tab, the token is no longer visible when you return. If you need a token, generate a new one.

:::hint{type="warning"}
**Important**
Keep your tokens secret and treat them like passwords. If you need a new one, revoke or delete the token and generate a new one.
:::

## Revoke a token

Revoking a token permanently removes it, so you can no longer use it to connect to the Feature Experimentation APIs. If you are an administrator, you can revoke any personal token attached to the account. If you are not an administrator for the account, you can only revoke the tokens that you generate for yourself.

To revoke and delete a token

1. Go to **Profile > API Access**.
2. Under **Personal Access Tokens**, click **Revoke**.
3. Click **Delete Token** to confirm. You cannot undo this action.

## Authenticate with your access token

To authenticate, use a token generated from the [previous instructions](docId\:pQfa5KPTbmy6crey-nsrd) in the request header, as shown in the following example. All API request examples in this documentation use the same header.

```curl
curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" "https://api.optimizely.com/v2/projects"
```

### Common error codes

- Using the wrong token causes the call to fail with the error `403 - Authentication Failed`.
- Forgetting to add the token or set the token on the wrong header or on the body, the request fails with a `401 - Unauthorized` error.