Overview

This article walks an account administrator through creating an API client, minting a token, and making a first successful API call from Postman or any other HTTP client.

Where to find it: Admin Panel → Settings → API Access

Prerequisites

• You must be an administrator on the account. API Access is not visible to non-admin users.
• Your account must be active. Suspended and churned accounts are refused at the API with a 403.
• An HTTP client such as Postman, curl, or an n8n HTTP Request node.

Steps

1. In the Admin Panel, open Settings → API Access.
2. Click Create API Client.
3. Enter a Client name. This identifies the automation, not a person — for example seat-sync. It must be unique within your account.
4. Enter an Owner email. This is the person accountable for the credential, not an account that logs in with it.
5. Enter a Token name, such as prod or staging. One client can hold several tokens over time.
6. Set Expires in days. The default is 90 days. The minimum is 1 and the maximum is 365.
7. Optionally add an IP allowlist. Leave it empty to allow any source IP. If you fill ses can use this client's tokens.
8. Optionally add Notes describing what the automation does.
9. Click Save. A modal appears showing the token in plain text.
10. Copy the token now and store it in your password manager or secret store. It is shown exactly once. The modal cannot be dismissed by clicking outside it or pressing Escape, because once you close it the plaintext is gone permanently — only a hash is stored, so it cannot be shown again. If you lose it, mint a new to
11. In Postman, create a new GET request to https://preview.giantrocketship.net/api/customer/v1/account.
12. Under the Authorization tab, choose type Bearer Token and paste thefer to set it manually, add the header Authorization: Bearer <your token>.
13. Send the request.

Result

You receive a 200 OK with a JSON body describing your account:

{
  "data": {
    "id": "01a017d7-a534-70fa-a9ef-7691251c7fdb",
    "name": "Acme Managed Services",
    "status": "active",
    "type": "standard",
    "is_active": true,
    "timezone": "America/Chicago",
    "locale": "en",
    "require_mfa": false,
    "counts": { "users": 19, "active_users": 15 },
    "created_at": "2026-08-19T02:26:43+00:00",
    "updated_at": "2026-08-19T20:18:43+00:00"
  }
}

Back in the Admin Panel, the client now appears in the API Access list, and its Tokens tab shows the token you minted with its name and expiry date.

What you can call

There are three read-only endpoints. All of them are GET, and none of them accept an accouount is determined by your token.

On the users list, per_page defaults to 25 and cannot exceed 100. A larger value is rejected with a 422 rather than quietly reduced, so an automation expecting 500 rows finds out instead of silently reading the first 100.

Unrecognised query parameters are always rejected with a 422 naming the parameter. A typo will not be i

Rate limits

Each token is allowed 60 requests per minute. Exceeding it returns 429 Too Many Requests with a Retry-After header telling you how many seconds to wait.

The limit is counted per token, so a client with two tokens has two separate budgets.

Managing clients and tokens

• Disable a client to pause it. Every call using its tokens immediately returns 403, the moment you re-enable it. This is reversible.
• Revoke a token to kill it permanently. The token is deleted and cannot be restored. Your request history still shows the token's name, so the audit trail survives.
• Tokens cannot be renewed. To rotate one, mint a replacement before the old one expiver to it, then revoke the old token.
• You are not warned before a token expires. Note the expiry date when you mint it.

Common errors

Every error is returned as JSON, including the 401 — you will never receive an HTML login page.

Security notes

• Any administrator on the account can mint a token, and every token can read the whole account. There are no per-token permissions.
• The API is read-only. No token can change anything.
• The IP allowlist checks the actual connecting address. It ignores X-Forwarded-For and similar headers, so it cannot be spoofed by a caller.
• Treat a token like a password. Anyone holding it can read your account and user list.