Keeping your token safe

Your API token can do everything its scopes allow with your RealScout account: read your contacts, their activity and your conversations, and, with contacts:write, change them. Treat it like a password.

Never paste it into an AI chat

Don't paste your token into Claude, ChatGPT or any other chat. The token is kept in the chat's history and can't be taken back out. Don't put it in an email, a shared doc, a support ticket or a screenshot either.

If a token ever ends up somewhere it shouldn't, revoke it on the API Tokens page and create a new one. Revoking takes effect immediately.

Store it in an environment variable

AI coding tools such as Claude Code, Cursor and Codex can read your token from an environment variable named REALSCOUT_API_TOKEN, so you never have to type it into the tool.

Mac

1. Open Terminal and run open -e ~/.zshrc. If it says the file doesn't exist, run touch ~/.zshrc first.
2. Add this line, with your token in place of your-token:

   export REALSCOUT_API_TOKEN="your-token"

1. Save the file, then quit and reopen Terminal and your AI tool.
2. To check it worked, run [ -n "$REALSCOUT_API_TOKEN" ] && echo set. It prints set without showing the token.

Windows

1. Open the Start menu and search for Edit environment variables for your account.
2. Under User variables, click New....
3. Enter REALSCOUT_API_TOKEN as the name and your token as the value, then click OK.
4. Quit and reopen your AI tool.
5. To check it worked, open PowerShell and run if ($env:REALSCOUT_API_TOKEN) { 'set' }.

Claude Code only

Claude Code can also take the variable from its own settings file, so no other program sees it. Add this to ~/.claude/settings.json (on Windows, %USERPROFILE%\.claude\settings.json):

{ "env": { "REALSCOUT_API_TOKEN": "your-token" } }

Each of these stores the token as plain text that only your user account can read. That keeps it out of chats, but anything running as you can still read it.

Give each tool its own token

Create a separate token for each tool or script, and grant only the scopes it needs. A tool that only reads your contacts doesn't need contacts:write. Separate tokens mean you can revoke one without breaking the others, and every call is recorded against the token that made it.