---
updatedAt: 2026-07-09T14:56:18.000Z
agentTools:
  projectIndex: https://developer.doit.com/llms.txt
---

# Get Started

Welcome to DoiT Cloud Intelligence™ Public API

# API Tokens

DoiT authenticates and authorizes API requests with API keys using [HTTP Bearer authentication](https://swagger.io/docs/specification/authentication/bearer-authentication/).

`Authorization: Bearer <YOUR_API_TOKEN>`

## Get a token

DoiT supports two token types for programmatic access.

* **Personal API token**: Use when building something for yourself: exporting billing data, pulling Cloud Analytics reports, or running internal scripts.

* **Service account API token**: Use when automation runs on shared infrastructure and must keep working if you change roles or leave your organization.&#x20;

Choose based on whether the integration runs as you or as shared organizational automation.

<Table>
  <thead>
    <tr>
      <th>
        Token type
      </th>

      <th>
        Best for
      </th>

      <th>
        Where to create it
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Personal API token
      </td>

      <td>
        Scripts, local tools, or automation tied to your user
      </td>

      <td>
        1. Sign in to the [DoiT console](https://app.doit.com/profile/api), select your avatar in the upper-right corner of the top navigation bar, and then select your name from the drop-down menu.&#x20;
        2. On the **API** tab, select **Create API token**.&#x20;
      </td>
    </tr>

    <tr>
      <td>
        Service account API token
      </td>

      <td>
        Shared automation (CI/CD, scheduled jobs, integrations) that should not depend on one person
      </td>

      <td>
        1. Sign in to the [DoiT console](https://app.doit.com/profile/api), select the gear icon from the top navigation bar, and then select **Users and access**.&#x20;
        2. Select **Service Accounts** from the left-hand menu.&#x20;
        3. Select a service account. Select **Create API token**.
      </td>
    </tr>
  </tbody>
</Table>

## Permission behavior

* Personal API tokens are limited to permissions your user role already grants. If your role changes, effective permissions may narrow.
* Service account API tokens use the service account's current permissions. Permission changes on the service account take effect immediately; removed permissions cause 403 on affected endpoints.
* Service accounts have no user email. For Cloud Analytics, reports must be shared organization-wide or be preset reports. Private user-only reports are not accessible via service account tokens.
* Each API operation enforces its own permissions.

## Security

Treat API tokens like passwords. Store them in a secrets manager or CI/CD secret store. Do not commit tokens to source control or share them in chat.

## Legacy API tokens

<br />If you still use a legacy API token from your user profile, it continues to work until revoked and reflects your current role permissions. Creating new legacy tokens is deprecated. Use a scoped personal API token or a service account token for new integrations.&#x20;

## Use tokens

Pass the token in every request's **Authorization** header.&#x20;

When you sign in to the API reference with your DoiT account, your legacy API token (if you still have one) may be prefilled in the **Authorization** header field in the top-right corner of the [API pages](https://developer.doit.com/reference/listalerts).

Personal API tokens and service account API tokens are not auto-selected. Copy a token from the [DoiT console](https://app.doit.com/profile/api) and paste it into the **Authorization** header field, or send it in your own requests as `Authorization: Bearer <YOUR_API_TOKEN>`.

## API endpoints

The **production** version of the DoiT Platform API is hosted at <https://api.doit.com>.

<Callout icon="🚧" theme="warn">
  ### Choosing the right endpoint

  Always use the production endpoint unless you're specifically looking for something not yet launched.
</Callout>

## Your first request

After you create an API token in the [DoiT console](https://app.doit.com/profile/api), verify that requests require authentication by calling the API endpoint without a token:

```shell
$ curl 'https://api.doit.com'
{
    "error": "Authorization field missing"
}
```

To call an endpoint, pass your token in the **Authorization** header: `Authorization: Bearer <YOUR API KEY>`.&#x20;

When you are signed in to the API reference, a legacy API token (if you still have one) may be prefilled in the **Authorization** field. Personal API tokens and service account API tokens are not auto-selected. Copy the token from the [DoiT console](https://app.doit.com/profile/api) and paste it into the field, or include it in your own requests.

Below is an example request that returns five reports:

```shell
$ curl --request GET \
     --head \
     --url 'https://api.doit.com/analytics/v1/reports?maxResults=5' \
     --header 'Authorization: Bearer eyJhbGci...' \
     --header 'Accept: application/json'
```

## We are happy to support you!

To open a support ticket, go to <https://support.doit.com>, sign in with your DoiT account, select `DoiT Platform` as the **Cloud Platform** and `DoiT Platform API` as the **Product**.

See [Create expert inquiries](https://help.doit.com/docs/services/consulting-support/create-support-request) for more information.

<br />