---
title: "Use a token in API calls"
description: "Send a Personal Access Token and its API key with each TIR API call, and keep the token in an environment variable instead of in your code."
content_type: "how-to"
product: "personal-access-tokens"
platform: "TIR"
url: "/tir/personal-access-tokens/how-to/use-a-token-in-api-calls/"
topic: ["tokens"]
relationships: {"requires":["/tir/personal-access-tokens/how-to/create-a-personal-access-token/"]}
---

# Use a token in API calls

An API call to TIR carries two values from your token: the API key in the address and the token itself in
the `Authorization` header. Keep both out of your code.

## Before you begin

You need a token and its config file; see
[Copy a token or download its config file](/tir/personal-access-tokens/how-to/copy-a-token-or-download-its-config-file/).
The file holds the API key that the address needs.

## Send a call

Add the API key to the address as `apikey`, and the token as a Bearer value in the `Authorization`
header. Most calls also take a `location`, `Delhi` or `Chennai`.

```bash
curl -H "Authorization: Bearer <your-token>" \
  "https://api.e2enetworks.com/myaccount/api/v1/gpu/<path>?apikey=<your-api-key>&location=<Delhi or Chennai>"
```

- `<your-token>` is the token's value from **Auth Token**.
- `<your-api-key>` is `api_key` from the config file.
- `<path>` is the call you are making; the TIR API reference lists each one.
- `<Delhi or Chennai>` is the location of the resource.

## Keep the token out of your code

Set the token as an environment variable so that it stays out of your code:

```bash
export TIR_API_TOKEN="<your-token>"
```

Then read it in your script:

```python
import os
token = os.environ["TIR_API_TOKEN"]
```

In a CI/CD pipeline, store the token and the API key as secrets of the pipeline instead of writing them in
the pipeline file.

## When the token stops working

- A token and its API key stop working 365 days after you create the token.
- Deleting the token stops them; see
  [Delete a token](/tir/personal-access-tokens/how-to/delete-a-personal-access-token/).