The Escher V2 public API (/v1/*) requires a Bearer token on every request. Create and manage tokens on the API tokens page — open the account menu in the bottom-left of the sidebar and choose API tokens (/settings/api-tokens).
You need API access enabled first
API tokens are gated. The page only lets you create tokens if API access is switched on for your account.
If it isn't, the page shows:
API access isn't enabled on your account. Contact your account manager at support@theprintspace.co.uk to request it.
Email support@theprintspace.co.uk to have it enabled, then come back to the page.
Who needs API tokens
- Artists building custom integrations (e.g. a portfolio site that triggers drops on demand).
- Agencies running multiple artist accounts via automation.
- Developers building internal tools that talk to the API.
If you only use the web UI to create drops manually, you don't need a token.
How to create
- Open the API tokens page (account menu → API tokens).
- Enter a Token name (the field placeholder reads "Token name (e.g. 'Backend CI')") so you can identify it later.
- Optionally enter a Webhook URL — see below. The field placeholder reads "Webhook URL (optional, https://…)"; leave it blank or give a full
https://URL. - Click Generate token.
- The full token is shown once, with the note "Copy this token now — it will never be shown again." Copy it immediately.
- Store it securely — a secrets manager, your CI/CD environment, or an
.envfile outside version control.
New tokens appear in the list with these columns: Name, Prefix, Webhook, Created, Last used. Only the prefix is stored — the full token can't be retrieved after creation.
Optional webhook URL
Each token can carry an optional https:// webhook URL. Set it when you generate the token, or edit it later: click the pencil next to a token's Webhook cell, enter a full https:// URL (or clear it), and save.
What you can do with the token
The full /v1 surface is documented at the OpenAPI endpoint (/openapi.json on the API service). Common operations:
- Create drops —
POST /v1/drops. - Add products to drops —
POST /v1/drops/{drop_id}/products. - Configure variants —
PUT /v1/drops/{drop_id}/products/{product_id}/variants. - Trigger publish —
POST /v1/drops/{drop_id}/publish. - Poll publish status —
GET /v1/drops/{drop_id}/publish-attempts/latest. - Generate recommendations —
POST /v1/recommendations. - Extract page styles from a URL —
POST /v1/styles/extract(returns five variations to choose from). - Save a page style preset —
POST /v1/styles.
Authentication
Pass the token as a Bearer header on every request:
Authorization: Bearer <your-token>
A missing, revoked, or invalid token returns HTTP 401. If API access has been disabled on the account, you get HTTP 403.
Rate limits
- Read endpoints: 120 requests per minute per user.
- Write endpoints: 30 requests per minute per user.
Exceeded calls get HTTP 429 with a Retry-After header. The limits are per-user, not per-token, so multiple tokens for the same user share the same bucket.
Token lifecycle
- Revoke — click the Revoke button on the token's row and confirm the dialog ("Revoke … This cannot be undone and the token will stop working immediately."). Future requests with that token return 401.
- Rotate — generate a new token, switch your integration to use it, then revoke the old one. No downtime if you do this in the right order.
- Expiry — tokens don't auto-expire by default. Rotate every 6–12 months as a security hygiene practice.
Don't share
Tokens are full credentials — anyone with one can act as you on the platform, including publishing drops and editing products. Treat them with the same care as a password.