Personal access token

Every API call is authenticated with an OAuth 2.0 Bearer token:

Authorization: Bearer <bearer-token>

A Personal access token is the simplest way in: generate it once in the dashboard and send it on every request. Use it when your server calls our APIs directly — scripts, integrations, testing. If instead other people sign in to your app, use App credentials (OAuth 2.0) instead.

The token acts with the access level of the user behind it: an account user's token sees that account; a partner Owner or Admin's token has partner-level access. It can also open the portal with no second sign-in (the rs-sso-login handoff). JumpCloud is separate — see JumpCloud SSO.

Before you start

• Base URL: https://production-api.shoutaboutus.com
• Portal: your portal URL (or your white label domain)
• Who can generate one: Partner users, and Account users whose account has single sign-on enabled. Other users don't see the Personal access token card.

No app credentials are needed — a Personal access token is generated directly on the API Keys page.

Generate it

1. Open the API Keys page in the dashboard.
2. Click Manage token on the Personal access token card.
3. Click Generate token, then Copy token.

Unlike a client secret, the token stays viewable — reopen the dialog any time to copy it again. Each user has one active Personal access token; the dialog shows when it was generated.

Use it

curl -s "https://production-api.shoutaboutus.com/api/v1/verify-token" \
  -H "Authorization: Bearer <your-personal-access-token>" \
  -H "Accept: application/json"

A successful response returns your user and account details — you're ready to call the rest of the API. Confirm any token with Check your token.

Validity and rotation

• The token does not expire — it stays valid until you regenerate it.
• Click Regenerate token to rotate it at any time — the previous token stops working the moment the new one is created, so update your integration straight after. Rotating periodically is good practice for a long-lived key.
• A temporary account lock (from failed sign-in attempts) does not disable an existing token. To cut off access immediately, regenerate the token or call GET /api/v1/sso/revoking-token with the token as the Bearer header.

Common questions

Which method should I use? Calling our APIs as yourself → Personal access token. Other people signing in to your app → App credentials (OAuth 2.0).

Does locking an account cut off its tokens? No. A temporary lock (from repeated failed sign-ins) stops new sign-ins, but a token issued earlier keeps working until you regenerate it.