Get a Woodander API token

Create a personal access token in Workspace Settings, pick the right scopes, set an expiry, and keep it safe. Every scope explained.

A token is the key your assistant uses to talk to Woodander. You create it in your Workspace, copy it once, and paste it into your client.

Create a token #

Sign in and open the Workspace.
Go to Settings → API & MCP.
Create a token: give it a name (for example "Claude Code laptop"), tick the scopes it needs, and optionally set an expiry date.
Copy the token right away. Woodander shows it once and stores only a hash. If you lose it, revoke it and create a new one.

Tokens look like wdr_....

If you do not see the page, or see only an upsell, your plan has no API access. See Limits and errors.

Scopes: give each token only what it needs #

A scope is a permission. A token with read:seo can read your SEO data and nothing else. Tick as few as you can.

Scope	What it allows
`read:products`	Read your Discover projects, project pages, leads and reviews.
`read:analytics`	Read Google Analytics (GA4) data and project analytics (views, clicks, visitors, leads, referrers).
`read:seo`	Read your sites, Search Console data, audits, uptime status and white-label reports.
`read:media`	Read your articles and drafts, including the Markdown body.
`read:keywords`	Keyword ideas, tracked keywords and rank history. Opt-in: not ticked by default.
`read:gtm`	Read your Google Tag Manager containers, tracking analysis, site scan and change requests.
`write:gtm`	Ask for changes in Tag Manager: tags, triggers, variables, versions. In Manual mode these become proposals. Not ticked by default.
`publish:gtm`	Lets the token publish a Tag Manager version without you, but only in Autonomous mode. Not ticked by default.
`write:products`	Ask for changes to your Discover project: page text, screenshots, Briefs, review replies, lead status. Not ticked by default.

A few things to know:

Write scopes are never ticked by default. You grant them on purpose.
publish:gtm does nothing in Manual or Hybrid mode. Publishing then always waits for you. More in Modes and approvals.
The form starts with the read scopes ticked (projects, analytics, SEO, articles). Keywords, Tag Manager and every write scope stay unticked until you tick them.
If you only have a Project Pro pass, your tokens can carry only read:products, write:products, read:market and write:market. The page lists just those four.
A read scope is not enough to change anything. A token with only read:seo cannot touch Tag Manager.

Pick an expiry #

Expiry is optional, but we like it. You can choose 30, 90, 180 or 365 days, or no expiry, and 90 days is preselected. A token for a one-off audit can be short-lived; a token on your own laptop can run longer. When a token expires, calls with it return 401 and you create a new one. You can have up to 20 tokens at once.

Check what a token can do #

Once connected, ask your assistant to call whoami. It returns the user behind the token, the plan, what is left of each plan limit, and the token's name, scopes, expiry and last-used time.

Revoke a token #

In Settings → API & MCP the list shows each token with when it was last used. Revoke any token there. It stops working at once. Do this when a laptop is lost, a teammate leaves, or you pasted a token in a chat by accident.

Keep it secret #

Never commit a token to git or put it in a public repo.
Store it in your client's config or an environment variable.
Use one token per tool or machine, so you can revoke one without breaking the others.
Do not paste it into shared docs or screenshots.

Next step #

Connect your client: Claude Code, Claude Desktop or Cursor.