API authentication

Every request needs an API token (Personal Access Token) in the Authorization header. A token acts as you: it sees your projects and analytics and can do what you can do in the dashboard, except managing tokens.

Create a token

Open the dashboard: API tokens.
Click Create token, give it a name you’ll recognize later (“Reporting script”, “Zapier”).
Copy the token. It starts with wmp_ and is shown only once — Warmup stores only its hash.

Use it

curl https://api.warmup.social/projects \
  -H "Authorization: Bearer wmp_YOUR_TOKEN"

const res = await fetch("https://api.warmup.social/projects", {
  headers: { Authorization: `Bearer ${process.env.WARMUP_TOKEN}` },
});
const { projects } = await res.json();

The token list in the dashboard shows when each token was last used.

Revoke a token

Click Revoke next to the token in the dashboard. Requests with a revoked token get 401 immediately.

Errors

Status	Meaning
`401`	The header is missing, the token is wrong, revoked or expired.
`403`	The action isn’t allowed with an API token (for example, creating tokens).