Generating API tokens

Caution

⚠️ For advanced and expert users. API tokens give programmatic access to your organization’s event data. They’re meant for technical users building integrations or syncing Sessionboard data with external systems. Claude, ChatGPT, Copilot, and Gemini do not use a token — they sign you in with OAuth. Start at Connect AI assistants. Before generating a token, we recommend reviewing our full API documentation: API Docs. It covers authentication, rate limiting, webhooks, and the SbQL query language in depth.

Training video · 5:42Integrations: registration, website and the APIWhat leaves Sessionboard and when, the App Marketplace, agenda and speaker embeds for your website, and the developer surface.

1. 0:02Three ways out of Sessionboard
2. 0:21Only the accepted set leaves
3. 0:47The App Marketplace
4. 1:20Inside an app
5. 1:50Embeds, the no-developer path
6. 2:23Building an embed
7. 2:57Attendee filters vs included sessions
8. 3:52Get the code
9. 4:25For your IT team
10. 4:54Single sign-on
11. 5:17Next steps

Training video · 6:07Live Transcribe: capture a session, tag who said it, publish what came outThe Live Transcribe home under Marketing with its Overview, Recaps, Attendee View, Invites and Settings tabs, the Settings that decide the model, statuses, keyterms, generic participant tags and AI outputs, the Live Transcribe Console an AV crew runs from a magic link, the Attendee View that publishes captions and transcripts, a diarized transcript with search and inline edits, the Tag speakers dialog that ties a voice to a contact or a generic tag, the contact profile the attribution lands on, the event report and session recaps with their approve and publish states, and the API token scope that lets your own app read it all.

1. 0:02The Live Transcribe home
2. 0:35Settings before the event
3. 1:16The Live Transcribe Console
4. 1:53Invites for the AV crew
5. 2:18The Attendee View
6. 2:48A transcript that came in
7. 3:17Tagging who said what
8. 3:49Where the attribution lands
9. 4:09Recaps, approve and publish
10. 5:15Reading it through the API
11. 5:44Where to go next

Training video · 6:14Integrations: get ready, map fields, read the sync logThe order of operations before a first sync (fields exist in Sessionboard first, the accepted set, participant roles), a saved connection and the one-event-to-one-destination mapping, where the Event ID and Organization ID come from, Event Settings per mapping, how the field map pairs a Sessionboard field with a destination field and why a mapped field can still be empty on the other side, Sync History and the Sync Results dialog, and API tokens for a partner who pulls data instead.

1. 0:02Before you connect
2. 0:23The setup tabs are the order
3. 0:44Fields first, then the accepted set
4. 1:07The connection
5. 1:31One event to one destination event
6. 2:01Event Settings are per mapping
7. 2:39The field map
8. 3:13Why a mapped field is missing
9. 3:35Unmapped means not sent
10. 3:56Sync History
11. 4:24Sync Results
12. 4:45Warnings and errors
13. 5:10API tokens and the public API
14. 5:46Fields, accept, connect, map, run, read

Why use it

An API token lets your own systems read and update Sessionboard directly, so data moves on a schedule instead of through spreadsheet exports. Use one to feed sessions and speakers to a website or app, pull reports into a BI tool, keep Awards programs and submissions in step with your association management system, or automate a job your team repeats every event. Scopes keep each token to exactly what that integration needs.

What you can do with an API token

API tokens let you:

• Sync your event data with external systems (CRMs, BI tools, custom dashboards)
• Build custom integrations using the Sessionboard Public API
• Run scheduled or programmatic reports through SbQL, including the read:insights scope

Tip

💡TIP- Before you start

• Tokens are generated at the organization level, not per event. Each token has access scoped to your org. You must be an organization administrator to generate, edit, or revoke tokens.
• Tokens are sensitive. Treat them like passwords — never share them in public channels, never commit them to source control, and store them in a secrets manager or environment variable.

Where to find your Event ID and Organization ID

Developers and integration partners ask for these alongside the token. Neither is secret, and neither is displayed on the API Tokens page — they are in the address bar.

• Event ID — the number after /event/ while you are inside the event: app.sessionboard.com/event/12345/sessions. It never changes, and it is the {eventId} in every event endpoint of the public API.
• Organization ID — the long identifier after /org/ while you are in Organization Settings: app.sessionboard.com/org/a1b2c3d4-…/settings/api-tokens. It is the {orgId} in the organization endpoints.

A developer who already has a token can also list every event it can see, with its id and name, by calling GET /v1/events. For the full pre-connection checklist — order of operations, field mapping and reading the sync history — see Before you connect.

How to generate an API token

1. Open Organization Settings

Log in to the Sessionboard admin dashboard and click Organization Settings in the sidebar.

2. Go to API Tokens

In the Organization Settings menu, select the API Tokens section.

3. Create a new token

Click Create Token. You’ll be asked for:

• A descriptive name (optional): e.g. “Tableau dashboard.” This helps you identify the token later when reviewing or revoking it.
• Permissions: see the next section.
• Event restrictions (optional): limit the token to specific events instead of your whole organization.

4. Choose token scopes

API tokens use scopes to control what the token can read or write. Every scope is its own checkbox — read scopes included — so grant only what your integration actually needs.

Read scope	What it does
read:events	Event data.
read:sessions	Session data.
read:contacts	Speaker and contact data.
read:reports	Saved reports.
read:dashboards	Dashboards.
read:insights	SbQL and the query APIs (/v1/insights/...). A token needs this scope to call them. Claude, ChatGPT, and the other assistants do not use a token.
read:transcriptions	Session transcriptions and recordings — the /transcriptions, /content and /content/documents routes that expose live transcripts, recaps and event reports.
read:media	Uploaded media items and their transcription status.
read:awards	Awards programs, categories, rounds, promo codes, submissions, and reviews.

Write scope	What it does
write:events	Create, update and delete dashboards, reports, agenda drafts, rules and personas.
write:sessions	Create, update, delete and restore sessions.
write:contacts	Create, update, delete and restore contacts.
write:exhibitors / write:sponsors	Create, update, delete and restore exhibitor and sponsor records.
write:fields	Create, update and delete custom fields.
write:metadata	Rooms, tracks, tags, formats, levels, languages and statuses.
write:transcriptions	Create, update and delete session transcriptions and recordings.
write:media	Upload media files for automatic transcription.
write:awards	Create, update, and delete Awards programs, categories, rounds, and promo codes, and update and delete submissions. A token created with no scopes cannot write Awards data.

For your security team’s SIEM, check Audit log export (read:audit_logs) instead. It replaces every other scope and creates a token that only reads your organization’s logs — see Export audit logs to a SIEM.

Note

📌 Note: If you don’t know which scopes you need, start with the read scopes for the records you use and add write scopes only when you have a clear use case for them.

5. Copy the token immediately

Note

🔒 Note: copy your token now. When you click Generate, the full token value is displayed only once. After you close the dialog, the full token is hidden for security and cannot be retrieved again. Copy it immediately and store it in a secure location (a password manager, secrets vault, or environment variable). If you lose it, you’ll need to generate a new one.

This is intentional behavior, we never store the full token in a way that can be displayed back to you, so even Sessionboard staff can’t recover it for you.

Using your token

Include the token in the x-access-token header on every API request. Example:

bash

curl -X GET https://public-api.sessionboard.com/v1/events -H “x-access-token: YOUR_TOKEN”

Use https://public-api.sessionboard.com for US-hosted organizations, https://public-api-eu.sessionboard.com for EU-hosted organizations, and https://public-api-me.sessionboard.com for Middle East–hosted organizations.

Note

💡TIP- For full endpoint documentation, request and response schemas, and code samples in JavaScript and Python, see the API Reference.

Where to find your Event ID and Organization ID

Integration partners and your own developers often ask for two numbers alongside the token. Both are in the address bar:

• Event ID — open the event and read the number after /event/ in the URL, for example …sessionboard.com/event/1234/dashboard → 1234. It is the same id the API returns from GET /v1/events.
• Organization ID — on an organization page (the Events list, Organization Settings) read the number after /org/, for example …sessionboard.com/org/56/events → 56.

The token itself is already tied to your organization, so most partners need only the Event ID. Credentials a partner issues — a client ID, secret, or their own event key — come from that partner’s admin console, not from Sessionboard; the connector pages under Apps say which ones each integration asks for.

Connecting AI assistants (Claude, ChatGPT, and other MCP clients)

Claude, ChatGPT, Microsoft Copilot, and Google Gemini connect by signing you in. That is OAuth. You do not generate a token for them, and Sessionboard does not show an MCP switch on the token or the organization.

Tip

Step-by-step setup, including the server URL for US, EU, and Middle East, starts at Connect AI assistants to Sessionboard: Claude, ChatGPT, Microsoft Copilot, and Google Gemini.

A token is for a script or integration that calls the public API directly, with the x-access-token header. To query reports and SbQL that way, include read:insights. A token created with no scopes is the older full-access form and can call those routes too. A token that lists scopes and leaves read:insights off cannot. Write scopes such as write:sessions are separate, and only matter when the caller should change data.

The hosted assistant URLs (https://mcp.sessionboard.com/mcp and the EU and Middle East hosts) accept the OAuth sign-in only. Pasting an API token into Claude or ChatGPT will not connect.

Security and best practices

• Treat responses as personal data. API responses, including report and SbQL query results, return contact details such as emails and phone numbers in full. Only give a token to an integration you trust with that data.
• Scope tokens narrowly. Generate separate tokens for separate integrations and grant only the scopes each one actually needs. A read-only Tableau dashboard doesn’t need write scopes; a sync job that only updates sessions doesn’t need write access to contacts.
• Restrict to specific events when possible. If a token only needs access to one event, scope it that way rather than giving it organization-wide access.
• Rotate tokens periodically and revoke them as soon as an integration is decommissioned. A token stops working when the person who created it is removed from the organization or set to Inactive, and works again if they are reactivated, so create integration tokens under an account that will stay.
• Never commit tokens to source control or share them in chat. If a token is compromised, revoke it immediately from the API Tokens settings page and generate a replacement.
• Audit log. All API calls are recorded with source, method, response time, and token ID. Organization administrators can review this log at any time.

Managing and revoking tokens

From the Organization Settings → API Tokens page you can:

• Rename a token
• Edit its scopes and event restrictions
• Revoke a token immediately (any integration using it will stop working)

Revoking a token cannot be undone. If you need to give the same integration access again, generate a new token and update the integration’s configuration with the new value.

Rate limits and caching

The Sessionboard API enforces rate limits to ensure fair usage. Build your integration to handle 429 Too Many Requests responses with exponential backoff. Some endpoints (individual session retrieval and session search) are cached for 3 minutes, so changes you make in Sessionboard may take up to 3 minutes to appear in API responses. Webhook notifications are not subject to this cache and are delivered in real time.

Note

For full details, see Rate Limiting.

Need help?

• Full API documentation: API Docs: Introduction
• Authentication reference: API Docs: Authentication
• MCP Server reference: API Docs: MCP Server
• Rate limiting: API Docs: Rate limiting

If your integration isn’t behaving as expected after following this guide, reach out to your Sessionboard account manager or support team and include the token name (never the token value) along with the error message you’re seeing.

Note

Need help? Contact us at support@sessionboard.com

Frequently asked questions

I don't see Organization Settings or API Tokens

API Tokens appears only for people whose organization role includes Can update organization settings (under Organization Settings in the role’s permissions). The default Admin role has it; Admin Lite does not.

1. Ask someone with the Admin role in your organization to open Settings > Team.
2. They can change your organization role to Admin, or to a custom role with Can update organization settings switched on (custom roles are on the Permissions tab).
3. Reload Sessionboard and open Settings > API Tokens.

If no one in your organization has the Admin role, email support@sessionboard.com. See Organization roles.