Help

Personal API tokens

Connect your own tools and AI assistants to Prezly with a token that only does what you allow.

A personal API token lets a tool you use (an AI assistant like Claude or ChatGPT, a script on your laptop, or an automation) work in Prezly on your behalf. You create the token yourself, choose exactly what it may do, and decide how long it lasts. You can revoke it at any time.

Personal API tokens are different from the account-wide API keys used for server-to-server integrations:

  • They act as you. A token can never do more than your own Prezly user is allowed to do.
  • They are scoped. A token only works for the permissions you tick when you create it.
  • They expire. Every token stops working after 30 days, 90 days or 1 year.

How do I create a personal API token?

  1. Go to Settings and click Personal API tokens (under your personal settings).
  2. Click Add new token.
  3. Give the token a Name that tells you where it is used, for example "Claude on my laptop" or "Weekly coverage script".
  4. Choose when it Expires: 30 days, 90 days or 1 year.
  5. Under Token permissions, tick only what the tool needs (see below).
  6. Click Create token.
  7. Copy the token and paste it into your tool, then click I copied it.

Important: the token is shown only once. Prezly doesn't store the token itself, so we can't show it to you again. If you lose it, revoke it and create a new one.

Choosing token permissions

Permissions are grouped by area of Prezly. Tick an area to allow everything in it, or tick individual permissions:

  • Stories: stories:read, stories:write (create and edit drafts), stories:publish (publish, schedule and unpublish)
  • Contacts: contacts:read, contacts:write
  • Campaigns: campaigns:read, campaigns:write, campaigns:send
  • Pitches: pitches:read, pitches:write, pitches:send
  • Coverage: coverage:read, coverage:write
  • Sites: sites:read, sites:write

A few things to know:

  • When you tick a write permission, the matching read permission is ticked automatically (and greyed out), because a tool can't edit what it can't see.
  • Everything except campaigns:send and pitches:send is ticked by default. Only tick the send permissions if you want the tool to send emails without you clicking send in Prezly.
  • Token permissions can only narrow down what you can do, never add to it. If your team role doesn't allow you to send campaigns, a token with campaigns:send still can't send them.

Pro tip: create a separate token for each tool. If you stop using a tool, or think its token may have leaked, you can revoke that one token without breaking anything else.

Using your token

Most tools just ask you to paste the token into a settings field. If you're building something yourself, send the token in the Authorization header of each request to the Prezly API:Authorization: Bearer ppat_...

Personal API tokens always start with ppat_. You can find the full technical reference, including which API endpoints accept personal tokens, in our developer documentation.

Connect an AI assistant to Prezly (MCP)

With a personal API token you can connect an AI assistant such as Claude or ChatGPT to Prezly through MCP (Model Context Protocol). The assistant can then find and summarise your stories, campaigns, newsrooms and contacts, prepare drafts for you, and, only if your token allows it, publish or send.

  1. Create a personal API token as described above. The permissions that are ticked by default are the ones MCP uses. Leave campaigns:send and pitches:send unticked unless you want the assistant to be able to send emails.
  2. In your AI assistant, add a custom connector (sometimes called a remote MCP server) with this URL: https://mcp.prezly.com/mcp
  3. Add your token as the connector's authorization header: Bearer ppat_...
  4. Start with a simple question, for example "List my Prezly newsrooms", to check that the connection works.

The steps differ slightly per assistant. Follow the MCP setup guide for step-by-step instructions, and read the MCP section of our developer documentation to see everything the assistant can do.

Managing your tokens

The Personal API tokens page lists every token you've created, with its status, prefix, expiry date and when it was last used. Click a token's name to see which permissions it has.

  • Active: the token works.
  • Expired: the expiry date has passed. Create a new token and update your tool.
  • Revoked: you (or Prezly) switched the token off.

How do I revoke a token?

  1. Go to Settings → Personal API tokens.
  2. Click Revoke next to the token.
  3. Confirm with Revoke token.

Any tool still using the token loses access immediately. Revoking can't be undone.

FAQs

Which plans include personal API tokens?

Personal API tokens are available on all current Prezly plans. Older (legacy) plans don't include them: on those, the Personal API tokens page shows an upgrade message instead. Get in touch with our Support team if you'd like to move to a current plan.

Can I see or edit a token after creating it?

You can see its name, status, expiry and permissions, but not the token itself, and you can't change its permissions. Create a new token with the permissions you need and revoke the old one.

What happens when a token expires?

The tool using it will stop working and get an "unauthorized" error. Create a new token and paste it into the tool.

My tool says a permission is missing. What do I do?

The token doesn't have the permission needed for that action. Create a new token that includes it. If the permission is ticked but the action still fails, check that your own Prezly user is allowed to do it, or ask an admin on your team.

Is it safe to share my token?

No. Treat a token like your password: anyone who has it can act as you within its permissions. Don't paste it into shared documents, emails, chat or code repositories.