API tokens

An API token lets a script, a server or an AI app that can't sign in publish to your sites, over the REST API and the MCP server. Chat apps such as Claude and ChatGPT don't need one: they sign in instead.

Last updated 13 October 2026 · View as Markdown

On this page

Say this to your AI
Create a token
Use it
What a token can do
Keep it safe

Say this to your AI

Tokens are made in your account, not in a chat. Once you have one, give it to your tool as an environment variable, for example:

bash

export PAGELEMON_TOKEN=pl_...

Then, in your code tool:

Copy into your AI chat

Publish the dist folder to my site maisoncafe on pagelemon.com

Create a token

Open app.pagelemon.com/account/tokens (Account settings → API tokens) and click Create token.
Give the token a name, such as the AI or computer it's for, and choose what it can do: Publish only (the default), or Publish and manage.
Click Create token and copy it straight away. It starts with pl_ and is shown only once.
Pick your tool (Claude Code, Codex or Other (curl)) and copy the setup shown, with your token already in it.

Each new token shows in your notifications, with what it can do, until when, and a link to revoke it. We usually email you about it too.

Use it

Send it as a header on every request:

bash

curl -sS -H "Authorization: Bearer $PAGELEMON_TOKEN" https://api.pagelemon.com/v1/sites

With the MCP server, set the same header in your app's MCP settings.

Codex reads it from an environment variable. In ~/.codex/config.toml:

toml

[mcp_servers.pagelemon]
url = "https://mcp.pagelemon.com"
bearer_token_env_var = "PAGELEMON_TOKEN"

Claude Code on a machine without a browser:

bash

claude mcp add --transport http pagelemon https://mcp.pagelemon.com --header "Authorization: Bearer pl_..."

What a token can do

Scope	Allows
`deploy` (always)	Publish and update sites, roll back, read sites, files and history, add and read forms and bookings, analytics, find domains, list people
`manage` (Publish and manage)	Also invite and remove people, set or remove a passcode, rename, archive, delete, transfer, add and remove domains, members-only. Sensitive actions still need your approval in the browser

A token limited to one site, such as the one handed to an AI when a site is kept (below), can only see and change that site.

Keep it safe

Tokens expire after 90 days. Make one for each AI or computer, so you can revoke them one at a time.
Treat a token like a password: not in chats, screenshots, site files or git. Don't commit a project config file that contains one.
Page Lemon stores only a hash of each token, so a lost token can't be shown again: create a new one.
Revoke a token at any time: in Account settings → API tokens, click Disconnect next to it. It stops working at once.

When a site published without an account is kept, the AI that published it can be handed a token limited to that site, valid for 30 days, so it can keep updating it.