API tokens
An API token lets a program act as you: the VS Code extension, the Markdrop CLI, a script, or a call to the API. Tokens start with mdk_.
Manage them at Settings › API tokens.
A token can do anything your account can: publish, change and delete your documents, and manage your workspaces. Keep it out of shared files and repositories. If one leaks, revoke it.
Create a token
#Open API tokens
#Go to Settings › API tokens and choose Create token.
Name it
#Name it after the device or script that will use it, like
My laptoporNightly report. Names can be up to 80 characters.Copy it now
#Choose Create token, then Copy token. This is the only time the full token is shown. Markdrop keeps only a hash of it, so it can't show it to you again.
Make one token for each device or script. Then you can revoke one without breaking the others.
You don't need to create a token for the VS Code extension. Install Markdrop Sync, run Markdrop: Sign in, and approve in the browser. Markdrop creates a token named "VS Code" for you. See Sync with VS Code.
Use a token
#Send it in the Authorization header:
curl https://api.markdrop.in/api/v1/auth/me \
-H "Authorization: Bearer $MARKDROP_TOKEN"
The CLI reads the same token from the MARKDROP_TOKEN environment variable. See Sign in and tokens.
Tokens don't expire. A revoked or mistyped token gets 401 Invalid API token; it's never treated as a signed-out visitor.
The hosted MCP server at https://api.markdrop.in/mcp doesn't accept API tokens. AI apps connect with their own sign-in, and you approve each one. See Connected apps. The local MCP server in the CLI does use an API token.
See and revoke tokens
#The list shows each token's Name, the start of the Token, when it was Created, and when it was Last used ("Never" if it hasn't been).
To revoke one, open its menu and choose Revoke, then Revoke token. Anything using it stops working at once; a VS Code extension using it stops syncing. This can't be undone. Create a new token if you need one again.