Skip to main content
Invoca’s self-serve API token access is OAuth-compliant. Accessing APIs using the API token enables customers to access and in some cases modify information through a third-party app or APIs without the risk of compromising security. It also ensures that secure, sensitive customer-related information is not exposed to the third-party app.

​
Create an API Token

To create an API token:
1
From the Main Navigation select ‘Integrations’ on the left-side panel, and then choose ‘Manage Integrations’.
Manage API Credentials
2
Once you’re on the ‘Integrations’ page, locate and click on the ‘Invoca APIs’ app.
Invoca API App
3
Go to the upper-right corner and click on the ‘+ New API Credential’ option.
4
Enter the Description and click Save.
It is strongly recommended to include a descriptive label that identifies the API type and its intended use.

​
Using API Tokens to Access Invoca APIs

Send the access token as an Authorization header on your request, of format "Authorization: <token>".
Do not pass API tokens as URL query parameters or in JSON request bodies. Tokens sent in URLs can be leaked through server logs, browser history, and referrer headers. Always use the Authorization header.
Example using Curl to make an API call with token-based authentication:

​
API Guidelines

  • Users should generate their own API tokens. Tokens should be treated like passwords and not be emailed or transmitted over other insecure mediums, nor should they be stored in a customer’s source code repository.
  • As a network user, you should not generate a token on behalf of Advertisers or Publishers as tokens inherit the privileges of the user generating it.
  • Invoca does not use OAuth refresh tokens.
Last modified on August 18, 2026