Can someone with my token publish offers on my behalf?

No. Every offer sent through the API waits for Vereel's review, and the API cannot publish. But the offers would be sent in your brand's name, so a leaked token should be revoked at once.

Can I see my token again?

No. Vereel keeps only a hash of it. If you lose it, revoke it and create a new one.

Is a read-only token safe to put in a dashboard?

It cannot create or change anything, but it can read your API offers, amounts included. Keep it on your server, not in the page that is sent to browsers.

What if I shared a GPT that holds my token?

Revoke the token in Settings › API tokens, make the GPT private or delete it, and create a new token for it.

Platform

How to Keep Your Vereel API Token Safe

By the Vereel team·October 29, 2026·6 min read

A smiling man in a white shirt holding a camera stabilizer at a wooden desk, with a ring light and a phone on a stand in the foreground

A Vereel API token lets a script, a tool or an AI agent send offers in your brand's name. That is the point, and it is also why a token deserves the care you would give a password: whoever holds it can act for your brand, within what the token allows. Here is what a token can and cannot do, where to keep it, and what to do the day it leaks.

What a token can do, and what it cannot

A token acts for your brand, and only for your brand, and only on offers created through the API. A read-and-write token can create offers, change them while they wait for review, add photos and read their status. A read-only token can only read them. Reading includes the amounts, because your own offers carry them.

A leaked token cannot:

Publish an offer: every offer waits for Vereel's review first.
Delete an offer, start a campaign or move money: the API has no such operations.
See another brand's offers, or your own offers created in the app.
Create more tokens: that needs your signed-in session.

Why it still matters

Every offer sent with a token carries the Cooperation Terms you accepted when you created that token, so an offer a stranger sends with it is an offer made in your name. Up to 20 of them can wait in review at once, each takes a reviewer's time, and each can show up in your campaigns list. Treat the token like a signature.

Keep it where only your code can read it

Most leaks are ordinary: a token left in a script that goes into a repository, or pasted into a chat to ask for help. A few habits prevent nearly all of them.

Put it in an environment variable, your hosting provider's secret store or your CI's secrets, not in the code.
Never put it in a web page, a mobile app, a spreadsheet, a chat message or a screenshot. Vereel's token routes refuse requests from other websites on purpose, so a token in a web page would not even work, and anyone could read it.
Keep it out of Git. If it was ever committed, treat it as leaked, even after you delete the commit.
Give each tool its own token and name it after the tool, so you can tell them apart and revoke one without stopping the rest.

Give it the least access and the shortest life

Choose read only for anything that only looks, such as a dashboard that shows the review status of your offers. Choose read and write only for the tool that creates offers.

Every token expires, after 30, 90 or 365 days as you choose. Pick the shortest period that is practical, and put the expiry date in your calendar, because a token that expires quietly looks like an outage. A brand can hold up to 10 live tokens at a time.

Watch for strangers

Settings › API tokens lists every token with its name, the start of the token, when it was created, when it expires and when it was last used, to within a minute. Any use you cannot explain is a reason to revoke the token.

Vereel also emails you whenever a token is created on your account. An email for a token nobody on your team created means someone with access to your account made it: revoke the token and change your password.

Replace it without stopping anything

To rotate a token, create the new one, give it to the tool, check that the tool works, and only then revoke the old one. Revoking takes effect on the next request, so do it after the switch. Do not reuse the name: add the date, for example “Shop feed 2026-11”.

If a token leaks

Act first and investigate afterwards: revoking costs a few minutes of an interrupted tool, and nothing else.

Revoke it in Settings › API tokens at once. The next request with it fails.
Open your campaigns and look for offers waiting for review that nobody sent. You can delete any of them there.
If you cannot explain how it leaked, change your password and check when your other tokens were last used.
Create a replacement, and fix the cause before you use it: remove the token from the repository history, the chat or the file where it was visible.

A token is a key to a narrow door: it cannot publish or pay, but it can speak for your brand. Keep it where only your code can read it, give it the least access and a short life, and you will rarely need the last section.

Frequently asked questions

Can someone with my token publish offers on my behalf?: No. Every offer sent through the API waits for Vereel's review, and the API cannot publish. But the offers would be sent in your brand's name, so a leaked token should be revoked at once.
Can I see my token again?: No. Vereel keeps only a hash of it. If you lose it, revoke it and create a new one.
Is a read-only token safe to put in a dashboard?: It cannot create or change anything, but it can read your API offers, amounts included. Keep it on your server, not in the page that is sent to browsers.
What if I shared a GPT that holds my token?: Revoke the token in Settings › API tokens, make the GPT private or delete it, and create a new token for it.