Project Tokens

Project tokens are access tokens tied to one project. Unlike personal access tokens, a project token can never reach another project, or any endpoint that is not part of a project.

Every project token has an access level, chosen when you create it: Read or Read & write. The token reaches the project's normal API endpoints, such as issues, comments, lanes, sprints, reports and error groups. Use Read for an integration that only looks, such as an internal dashboard. Use Read & write for one that sends data, such as a CI pipeline, a feedback widget or an error reporter.

Access Levels

Access level	access	Scopes	Allows
Read	0	read, project-bound	The GET endpoints of its own project, except those listed below
Read & write	1	read, write, project-bound	Its own project's endpoints, writes included, except those listed below

A project token acts as the member who created it. Every endpoint checks the creator's permissions, so the token never does more in the project than its creator can. If the creator loses access to the project, the token loses it too.

A Read token gets 403 on every write, including submitting reports and ingesting error or token events. Neither access level reaches:

• Another project. A request for another project's endpoints gets 403, even when the creator is a member of that project.
• Any endpoint outside a project, such as GET /api/users, POST /api/profile/update, GET /api/projects, GET /api/issues/search, GET /api/auth/user or /api/two-factor/*. To list a project's members, call GET /api/projects/{projectId}/members instead of GET /api/users.
• The project's administration endpoints, whatever the creator's role: updating, deleting, archiving or restoring the project, transferring its ownership, its avatar, the lane GitHub triggers (PUT .../lanes/github-triggers), linking or unlinking GitHub repositories, and everything under .../project-tokens and .../ai-keys.

Each project token has its own rate limit of 120 requests per minute, apart from its creator's. Error and token event ingestion keep their own limits. A project token's requests do not count as its creator visiting the project.

Tokens Created Before Access Levels

Project tokens created before 2026-10-05 were converted to an access level. A token that submitted reports, error events or token events is now Read & write and reaches the whole project API as its creator, not only the endpoint it was made for. If such a token sits where people outside your team can read it, such as a feedback widget on a public page, replace it with a token whose creator holds only the permissions the integration needs. See the 2026-10-05 changelog entry.

Creating a Token

Project tokens are created in the kendo app, under each project's settings:

1. Open the project and go to Settings (/projects/{projectId}/settings).
2. Scroll to the API Tokens section.
3. Click Create Token, give it a recognizable Name (e.g. CI/CD Pipeline), and choose its Access: Read (the default) or Read & write. A token that submits reports, error events or token events needs Read & write.
4. Click Create. The plain-text token is shown only once — copy it immediately into a secure location (CI secrets, environment variables). It cannot be retrieved later.

The token list shows each token's name, access level and status; deleting a token there revokes it instantly. Deleting the project revokes all of its tokens. A token's access level is fixed at creation — to change it, create a new token and delete the old one.

Requires the Project API Tokens feature

The API Tokens section only appears when the Project API Tokens feature is enabled for your workspace. If you don't see it, the feature is off for your plan. A project token is refused while the feature is off.

Creating a Token Through the API

Call the endpoint with a personal access token, as a member who may manage the project's tokens:

Request

curl -X POST https://{tenant}.kendo.dev/api/projects/1/project-tokens \
  -H "Authorization: Bearer your-personal-token" \
  -H "Content-Type: application/json" \
  -d '{"name": "Dashboard", "access": 0}'

Response 201

{
  "token": {
    "id": 7,
    "name": "Dashboard",
    "access": 0,
    "active": true,
    "created_at": "2026-10-05T10:00:00.000000Z"
  },
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..."
}

Field	Type	Required	Description
name	string	Yes	Token name, max 255 characters
access	integer	Yes	0 Read, 1 Read & write

access_token is the plain-text token, shown only in this response. In the token list (GET /api/projects/{projectId}/project-tokens), access is null when a token's scopes are not exactly those of one access level.

Submitting Reports

With a Read & write project token, submit reports via the Reports API:

Request

curl -X POST https://{tenant}.kendo.dev/api/projects/1/reports \
  -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Deployment failed",
    "description": "Build #1234 failed with exit code 1. See logs at ...",
    "author_name": "CI Pipeline"
  }'

Response 201

{
  "id": 1,
  "title": "Deployment failed",
  "description": "Build #1234 failed with exit code 1. See logs at ...",
  "source": 1,
  "author_name": "CI Pipeline",
  "project_id": 1,
  "created_by": null,
  "promoted_issue_id": null,
  "promoted_at": null,
  "dismissed_at": null,
  "dismiss_reason": null,
  "dismiss_reason_note": null,
  "rank": "i",
  "attachments_count": 0,
  "created_at": "2026-03-20T10:00:00.000000Z",
  "updated_at": "2026-03-20T10:00:00.000000Z"
}

Request Fields

Field	Type	Required	Description
title	string	Yes	Report title, max 255 characters
description	string	Yes	Report description, max 65,535 characters
author_name	string	No	Name of the external reporter (e.g., service or person)
files	file[]	No	Up to 5 image attachments (jpg, jpeg, png, gif, webp, bmp, tiff; max 3 MB each)

Reports created with a project token automatically have source: 1 (Api) and created_by: null, distinguishing them from manually submitted reports.

Restrictions

Project tokens are intentionally limited:

• Only the project they were created for — every other project, and every endpoint outside a project, responds with 403
• Only what their access level grants — a Read token cannot write
• Never the project's administration endpoints
• Only while the token is active — a deactivated token is rejected

Common Errors

Status	Cause
401	Token is invalid, revoked, or expired, or its project was deleted
403	Token lacks the access level the endpoint needs; the endpoint belongs to another project, to no project, or to the project's administration; the token is inactive or no longer linked to its project; or the Project API Tokens feature is off
422	Request validation failed

See Also

• Reports API — Full report endpoint documentation
• Error Events API — Ingest application errors via a project token
• Tokens API — Personal access tokens for full API access