Access the Videas API (developers)

To call the Videas API: open Settings → API access, create a token by ticking its scopes and its expiry, then authenticate your requests with the Authorization: Bearer <your-token> header. The REST API covers importing videos from an LMS, syncing metadata with a CRM, retrieving your analytics and automating your publishing workflows.

You will need basic REST knowledge (HTTP methods, headers, JSON) and an HTTP client (curl, Postman, Insomnia…). No particular role is required: tokens are personal, and each member creates their own. Interactive documentation also lists every available endpoint.

Step 1: Access token management

API tokens are tied to your user account (not to the organization). Each member of your team creates their own tokens — no particular role is required, you just need to be signed in.

From your Settings, open the API access page (API tokens page). The screen shows a header with three counters: Total tokens, Active tokens, Expiring soon. Below it, the list of your existing tokens (empty on your first visit).

Important: because tokens are personal, never share your tokens with a colleague. If several people need access to the API, each one creates their own tokens. This is also what makes it possible to properly trace who does what through the API.

Step 2: Create a token

Click Create a token: the Create API token dialog opens with three fields — a name, the permissions, an expiry.

Token name

Give it a descriptive name that says what the token will be used for. Examples:

• HubSpot CRM sync
• LMS import - nightly script
• Internal analytics dashboard
• Postman local dev tests

This is what appears in the list, and it is invaluable once you manage several tokens in parallel.

Permissions (scopes)

Permissions (scopes) define what the token can do. You tick them as labels; at least one is required. They follow the form <resource>:<action>:

Scope	What it allows
users:read · users:write	Read / update user info
assets:read · assets:write · assets:delete	Read / create-update / delete media
files:read · files:write · files:delete	Read / upload / delete files
platforms:read · platforms:write	Read / update channels
billing:read · billing:write	Read / update billing
helpdesk:read · helpdesk:write	Read / write on the help center side

Principle of least privilege: tick only the scopes your integration strictly needs. A script that only needs to import videos should not have assets:delete. That way you limit the damage if the token ever leaks.

Expiry

Choose when the token should expire:

• No expiry: the token stays active until you revoke it
• 30 / 60 / 90 days: for temporary integrations (testing, one-off migration, short assignment)
• 1 year: a reasonable compromise for long-term integrations

Best practice: prefer a set expiry over “No expiry”, even for long-term integrations. Renewing your token every year or every six months is a rotation that limits the impact of a silent compromise.

Confirm with Create token.

Step 3: Copy the token value

Once confirmed, the Token created dialog shows the full value of the token, once only, with the warning “Make sure you copy your token now. You will not be able to see it again.”

Click Copy token and store it immediately in a secrets manager or in your application. If you close the dialog without copying it, you will not be able to retrieve it: you will have to delete that token and create a new one.

Bad practice to avoid at all costs: never paste your token into a Slack message, an email, a Git commit, or a shared Google Doc. Store it exclusively in:

• A secrets manager (1Password, Bitwarden, AWS Secrets Manager, Doppler…)
• An environment variable read by your application at runtime
• An uncommitted .env file (added to .gitignore)

Step 4: Make your first call

The Videas API is exposed at:

https://app.videas.com/api/external/

Authentication uses the Authorization: Bearer <your-token> header.

Example: list your media

curl -H "Authorization: Bearer $VIDEAS_API_TOKEN" \
     https://app.videas.com/api/external/assets/

The response is JSON, with the list of media accessible within the token’s scopes.

Python example

import os
import requests

API_TOKEN = os.environ["VIDEAS_API_TOKEN"]
BASE_URL = "https://app.videas.com/api/external"

response = requests.get(
    f"{BASE_URL}/assets/",
    headers={"Authorization": f"Bearer {API_TOKEN}"},
)
response.raise_for_status()
assets = response.json()

JavaScript example (Node.js)

const response = await fetch('https://app.videas.com/api/external/assets/', {
  headers: {
    Authorization: `Bearer ${process.env.VIDEAS_API_TOKEN}`,
  },
})
const assets = await response.json()

If the response is 401 Unauthorized, check: the Bearer prefix, the absence of a stray space, the validity of the token (not revoked, not expired), the scopes (your endpoint must be covered).

Step 5: Track token usage

In the token list, each row shows:

• Name + description
• Prefix: the first characters of the token, to identify it without exposing the full value
• Permissions: the enabled scopes (chips), with a counter beyond 2
• Status: Active (green) or Revoked (red)
• Last used: useful for spotting dormant tokens
• Expires: the expiry date, or Never

The page header recaps the overall state: how many tokens you have, how many are active, how many expire in the coming days. Review this screen quarterly as part of good access hygiene.

Step 6: Revoke a token

If a token is compromised, is no longer used, or needs renewing:

1. In the list, find the token concerned
2. Click the Delete action
3. Confirm

⚠️ This cannot be undone: the token becomes invalid immediately. Every call in flight will fail with 401. If the application using it has no fallback, plan to create the replacement before you revoke.

Interactive API documentation

To explore the exhaustive list of endpoints, their parameters, their response schemas and their error codes, open the Videas API documentation. It is generated automatically from the code (OpenAPI / Swagger) — so it is always up to date with what the server actually exposes.

You will find in particular:

• The full inventory of endpoints (media, workspaces, collections, analytics, shares, embeds…)
• The JSON schemas of the objects received and sent
• The ability to test calls straight from the docs by pasting your token

Security best practices

Storage

• Never commit a token to a Git repository (use .env + .gitignore)
• Use a secrets manager for shared environments (CI/CD, production)
• Read tokens from environment variables at runtime

Rotation

• Set an expiry on every token (90 days for everyday use, 1 year max for long-term integrations)
• Put a documented renewal procedure in place (who, when, how)

Monitoring

• Review the token list quarterly: revoke the inactive ones (a Last used field that no longer moves)
• Watch for overly broad scopes and narrow them where possible
• Document what each active token is for (at minimum in the description)

Compromise

• If you suspect a token has leaked (accidental commit, shared by mistake, exposed log file…): revoke it immediately, create a new token, update the applications that consume it

Can an API token be shared between colleagues?

No, never. Tokens are attached to your user account, not to the organization: each team member creates their own, and no particular role is required to do so.

That is what allows proper tracing of who does what through the API, and lets you revoke one person’s access without breaking anyone else’s integrations. A shared token, by contrast, makes revocation impossible without interrupting everybody.

I closed the window without copying my token — what now?

Create it again. The full value is shown only once, at creation — the warning says so explicitly — and Videas does not keep it in clear text. There is therefore no way to recover it afterwards.

Delete the now-unusable token and create a new one. The list afterwards only shows its prefix, the first few characters, which serve to identify it without exposing the value.

Where should an API token be stored?

In a secrets manager (1Password, Bitwarden, AWS Secrets Manager, Doppler), in an environment variable read at runtime, or in a .env file added to .gitignore.

Never in a Slack message, an email, a Git commit or a shared document. The accidental commit is by far the most frequent leak, and the most lasting: a token pushed once stays in the repository history even after the file is deleted.

Should I set an expiry on my tokens?

Yes, even for a long-term integration. The No expiry option exists, but a token that never dies is a token nobody remembers — and one whose silent leak stays exploitable indefinitely.

Count on 90 days for everyday use and one year at most for lasting integrations. Periodic renewal is what limits the impact of a compromise you did not detect.

What should I do if a token leaks?

Revoke it immediately, then create its replacement and update the applications that used it. Revocation is instant and irreversible: every call in flight fails at once with a 401.

For a production integration with no fallback, the reverse order is safer: create the new token first, deploy it, then delete the old one.

What does a 401 Unauthorized response mean?

That authentication was not accepted. Four causes, to check in this order: a missing Bearer prefix in the header, a stray space in the copied value, a revoked or expired token, or scopes insufficient for the endpoint called.

Scopes are the least obvious cause: a token carrying only assets:read will return an error on a write, even though it is perfectly valid otherwise. That is the price of least privilege — tick only what you need, but know what you ticked.

In short

• API tokens are personal, created from Settings > API access
• Configure a name, a description, scopes (<resource>:<action>) and an expiry
• The token value is shown only once, at creation — copy it immediately
• The API is exposed at https://app.videas.com/api/external/, authenticated with Authorization: Bearer <token>
• The interactive documentation lists every available endpoint
• Apply the principle of least privilege to scopes and renew your tokens regularly
• If a token is compromised, revoke it immediately and create a new one

Related articles

• Videas API documentation
• Manage roles and permissions
• Manage your Videas organization