Create a personal access token
A personal access token isn’t the API key you use for model requests. It calls account endpoints and can do only what its scopes allow. Keep it on your server in an environment variable or a secrets manager, and never ship it to a browser or client app.1
Open personal access tokens
Sign in to the console, open personal settings, go to Security & Access → Personal access tokens, and create a new token.
2
Name it and pick scopes
Use a name that says what the token is for, such as “balance alerts”. Grant only the scopes your script needs:
- Balance:
profile:read - Call log export as well: add
usage:read(see the log query API) - API key management:
api_key:read,api_key:write, orapi_key:revealas needed (see the token management API)
3
Copy the token
The token starts with
nap_ and is shown only once. Copy it right away and store it securely.Endpoint
- Pass the token itself as the
Authorizationvalue, as the examples below do; aBearerprefix also works. Accept: application/jsonandContent-Type: application/jsonare optional.- With cURL, add
--compressedso that the response is decompressed.
Response
A successful request returns:
The response can include other fields, depending on the account. Read only the fields you need, and let your parser ignore unknown ones.
Convert quota to US dollars
quota and used_quota are returned in quota units, not dollars. 500,000 quota units are about 1 USD.
Use this conversion for display. What a request actually costs depends on the model price, your token group, and the charge shown in call logs. For alerts, store the raw
quota together with the converted amount so that you keep full precision.
Code examples
Set the personal access token in your terminal once, replacing the placeholder. Scripts that used the legacy AccessToken only need the new value in this variable:- cURL
- cURL with jq
- Python
- Node.js
--compressed, the terminal can show garbled output, and jq can report Invalid numeric literal.Errors
401 Unauthorized
Authentication failures return HTTP 401, and thecode field says why. A request that still uses the legacy token returns:
Fix a 401 from the balance API walks through the common causes. Check
success in your script instead of relying on the status code alone.
Garbled output or a jq error
If cURL prints garbled characters orjq reports Invalid numeric literal, the compressed response was not decoded. Add --compressed to the cURL command.
Monitoring recommendations
To get warned before your balance runs low, run a scheduled check against this endpoint. This script exits with status 1 when the remaining balance falls below a threshold:LAOZHANG_ACCESS_TOKEN in the script or crontab. When you set it up:
- Store
LAOZHANG_ACCESS_TOKENin an environment variable or a secrets manager. - Set a request timeout, such as 10 seconds.
- Poll at a modest interval; balance alerts rarely need per-second checks.
- Include
quota, the converted balance,used_quota,request_count, the request time, and the HTTP status in alerts. - Never log the
Authorizationheader,access_token, or other sensitive account fields. - Changing your password, 2FA, or passkeys revokes the token and the check starts returning 401, so replace the token after any security change.
Related documentation
- Balance API FAQ: garbled output, 401 errors, and personal access tokens vs. API keys
- Why a request can fail with remaining balance
- How to review and use call logs
- Log query API: export call records and charges from code
- Token management API: create, disable, and delete API keys from code
- Billing, token groups, and invoices