Skip to main content
The legacy system AccessToken stopped working on November 9, 2026.
  • Requests that still use it get HTTP 401 with code set to ACCESS_TOKEN_LEGACY_RETIRED.
  • Create a personal access token and swap it into your script. The endpoint, request format, and response fields are unchanged.

Create a personal access token

A personal access token isn’t the API key you use for model requests. It calls account endpoints and can do only what its scopes allow. Keep it on your server in an environment variable or a secrets manager, and never ship it to a browser or client app.
1

Open personal access tokens

Sign in to the console, open personal settings, go to Security & Access → Personal access tokens, and create a new token.
2

Name it and pick scopes

Use a name that says what the token is for, such as “balance alerts”. Grant only the scopes your script needs:
  • Balance: profile:read
  • Call log export as well: add usage:read (see the log query API)
  • API key management: api_key:read, api_key:write, or api_key:reveal as needed (see the token management API)
You can also set an IP allowlist and an expiry date.
3

Copy the token

The token starts with nap_ and is shown only once. Copy it right away and store it securely.
Changing your password, 2FA, or passkeys revokes every personal access token.
  • Create new tokens afterwards and update every service that used the old ones.
  • An account can have up to 20 personal access tokens.
  • Do not put a token in source code, browser apps, logs, screenshots, or support tickets. When you ask support for help, send the request time, HTTP status, the code from the response, and a redacted command.

Endpoint

The request takes no query parameters or body, and the response is JSON.
  • Pass the token itself as the Authorization value, as the examples below do; a Bearer prefix also works.
  • Accept: application/json and Content-Type: application/json are optional.
  • With cURL, add --compressed so that the response is decompressed.

Response

A successful request returns:
The response can include other fields, depending on the account. Read only the fields you need, and let your parser ignore unknown ones.

Convert quota to US dollars

quota and used_quota are returned in quota units, not dollars. 500,000 quota units are about 1 USD. Use this conversion for display. What a request actually costs depends on the model price, your token group, and the charge shown in call logs. For alerts, store the raw quota together with the converted amount so that you keep full precision.

Code examples

Set the personal access token in your terminal once, replacing the placeholder. Scripts that used the legacy AccessToken only need the new value in this variable:
Without --compressed, the terminal can show garbled output, and jq can report Invalid numeric literal.

Errors

401 Unauthorized

Authentication failures return HTTP 401, and the code field says why. A request that still uses the legacy token returns:
Fix a 401 from the balance API walks through the common causes. Check success in your script instead of relying on the status code alone.

Garbled output or a jq error

If cURL prints garbled characters or jq reports Invalid numeric literal, the compressed response was not decoded. Add --compressed to the cURL command.

Monitoring recommendations

To get warned before your balance runs low, run a scheduled check against this endpoint. This script exits with status 1 when the remaining balance falls below a threshold:
Run it from cron or your monitoring system every 10–30 minutes and send a notification on a non-zero exit, for example:
Cron doesn’t load your shell environment, so provide LAOZHANG_ACCESS_TOKEN in the script or crontab. When you set it up:
  • Store LAOZHANG_ACCESS_TOKEN in an environment variable or a secrets manager.
  • Set a request timeout, such as 10 seconds.
  • Poll at a modest interval; balance alerts rarely need per-second checks.
  • Include quota, the converted balance, used_quota, request_count, the request time, and the HTTP status in alerts.
  • Never log the Authorization header, access_token, or other sensitive account fields.
  • Changing your password, 2FA, or passkeys revokes the token and the check starts returning 401, so replace the token after any security change.