> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.etals.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.etals.com/_mcp/server.

# Authorization

Etals API requests are authenticated with Bearer tokens.

Include the token in the `Authorization` header for each request:

```http
Authorization: Bearer {api-token}
```

## Creating a token

API tokens can be created from the Etals settings area.

Each token has abilities that control what it can do:

| Ability  | Used for                                  |
| -------- | ----------------------------------------- |
| `read`   | Reading data from the API.                |
| `create` | Creating data or sending data into Etals. |
| `update` | Updating existing data.                   |
| `delete` | Deleting data.                            |

## Funnel API permissions

The Funnel API uses token abilities and user permissions.

| Endpoint                                | Required token ability | Required user permission |
| --------------------------------------- | ---------------------- | ------------------------ |
| `POST /api/v1/funnels/{endpoint-url}`   | `create`               | Manage funnels           |
| `DELETE /api/v1/funnels/{endpoint-url}` | `delete`               | Manage funnels           |

If the token is missing, invalid, or does not have the required ability, Etals returns an authorization error.

## Example request

```bash
curl -X POST "https://{tenant-domain}/api/v1/funnels/{endpoint-url}" \
  -H "Authorization: Bearer {api-token}" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "SKU-1001",
    "name": "Everyday Face Cream"
  }'
```

## Token safety

Treat API tokens like passwords.

Do not expose tokens in frontend code, public repositories, screenshots, or shared documents. If a token may have been exposed, revoke it and create a new one.