Public API authentication

Create, store, and revoke a personal API token safely.

Public API requests use a personal token in the Bearer authorization header:

Authorization: Bearer mono_pat_...

Personal tokens belong to one Monologue user. The supported scope is currently notes:read.

Create a token

Open Settings → Notes → API Keys in the Monologue Mac app. Choose a name that identifies the integration, create the token, and copy the secret immediately. You will not be able to reveal the same secret later.

You can optionally set an expiration date. Prefer a short useful lifetime for scripts or temporary integrations.

Store it safely

• Put the token in a server-side environment variable or secret manager.
• Never embed it in a website, browser extension, distributed app, or client-side bundle.
• Use a separate token for each integration so you can revoke one without affecting the others.
• Do not include the token in URLs, logs, analytics events, or support requests.

Revoke a token

Return to Settings → Notes → API Keys and revoke the key. Requests using it will begin returning 401. If a token may have leaked, revoke it immediately and create a replacement.