> For the complete documentation index, see [llms.txt](https://docs.tiny.plus/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tiny.plus/api/getting-access/getting-an-access-token.md).

# Simple access token

## Building an integration just for your company?

Are you building an integration to only access your own tiny+ data?

Rather than registering an app, you can get a simple long-life access token by visiting [crm.tiny.plus/account/api\_access](https://crm.tiny.plus/account/api_access). You'll need to be an *account admin* to open this page.

There are two kinds of token:

* A **ReadWrite** token can read and change your tiny+ data.
* A **ReadOnly** token can only read it.

A token lasts ten years. It is shown once, when you generate it, so copy it somewhere safe straight away.

Send the token in the `Authorization` header of every request:

```
Authorization: Bearer {{user_access_token}}
```

## Important considerations...

{% hint style="info" %}
Treat your access token like a password. Anyone who has it can access your tiny+ account.
{% endhint %}

A couple of really important points about how to use your access token.

1. **Treat your access token like a password to your tiny+ account.**\
   This means that you should NEVER include it in a public Git repository, or in the Javascript code of a website you build.
2. **Only use these access tokens in server-side code.**\
   These tokens should only ever be used in server-side code, such as in a PHP script.
3. **Actions performed when using our API with this access token will be in the context of your user account.**\
   It may be worthwhile creating a user account in tiny+ that belongs to the integration you are building.
4. **The access token belongs to your user account, not to the tiny+ account.**\
   If you belong to more than one tiny+ account, add `account={account id}` to a request to choose which account it's for. [Requests, responses and errors](/api/concepts/requests.md#choosing-an-account) explains how.
5. **The access token will stop working if your user account is disabled or deleted, or if the tiny+ account is closed.**\
   You will need another user to generate a new access token if your account is ever going to be deleted.

If you believe your access token has been compromised, you should go to [crm.tiny.plus/account/api\_access](https://crm.tiny.plus/account/api_access) as soon as possible, revoke it, and generate a new one.