# What is the difference between my account API token and a scoped credential?

Your account API token was minted automatically when the account was created. It sits pinned as the first row in Settings -> API with the type "Automatic", carries a fixed set of scopes, can be revealed again at any time, and can be rotated but never revoked. It is a 64-character string with no prefix.

A scoped credential is one you name and mint yourself, with only the scopes you grant and an optional expiration. It is shown once, and it can be revoked on its own. It begins cmk_ and is 68 characters long.

Either one travels the same way: the header name is Authorization, and the value is the word Bearer, then one space, then the token itself.

Here is the part that catches people out. The account token carries the intake and webhook write scopes, not the account-wide read scopes, so a GET to /api/v2 with it answers 401. Mint a scoped credential for reads.

Read online: https://docs.closemagnet.com/articles/questions/account-token-vs-scoped-credential