API tokens

API tokens connect the browser extension to your account. They're bearer credentials: anyone holding a token can act as you, so treat them like passwords.

Creating a token

1. Open your Account page and find the tokens section.
2. Name the token for where it will live — "Work laptop Chrome," "iPhone" — so you can tell them apart later.
3. Create it and copy it immediately. Tokens start with rz_ and are shown only once; we store only a hash, so it can't be displayed again.

If you connected the browser extension with Connect Rezai account, a token was created for it automatically — you'll see it in the list like any other.

Using a token

• Browser extension — paste into the extension's settings (only needed for manual setup; the one-click connect handles it otherwise).

Revoking

Revoke any token from the Account page. The device using it loses access immediately and everything else keeps working. Revoke and re-issue whenever:

• you lose or replace a device,
• you pasted a token somewhere you shouldn't have,
• a token you don't recognize appears in the list.

Good hygiene

• One token per device or app — never share one token across places, or revoking becomes all-or-nothing.
• Don't put tokens in scripts, screenshots, or messages.
• If in doubt, revoke — creating a new token takes seconds.