The public API: tokens, rate limits and idempotency keys

Tokens

1. Open Settings, then API access, and create a token.
2. Name it after what will hold it, such as "n8n" or "the deploy script".
3. Choose what it may do. A read token can read accounts, posts, media and metrics and change nothing. A write token can also write posts into the workspace, and only an admin or owner can create one.
4. Copy the token. It is shown once, and only a hash of it is stored, so nobody can read it back to you.
5. Send it on every request as Authorization: Bearer followed by the token.

A token follows its creator

A token can never do more than the person who created it. If they move to a lower role or leave the workspace, their tokens follow. Revoking a token stops it working immediately.

Rate limits

Each token has one counter per minute, shared by reads and writes. A GET is refused once that minute's count passes 300, and a POST, PATCH or DELETE once it passes 60. A refused request answers 429 with a Retry-After header giving the seconds to wait.

Idempotency keys

Send an Idempotency-Key header on a write, holding a string you generate once per logical request, up to 255 characters. If the request is retried with the same key and the same body within 24 hours, you get the first response back and nothing is created twice. The same key with a different body is refused, and a retry while the first request is still running is told to try again in a moment.

MCP

Point any MCP client at the endpoint shown on API access, with the token in an Authorization header. Each MCP tool calls the same code as its REST endpoint, so an agent and a script see the same rows.