# Keeping your token safe

Your API token can do everything its scopes allow with your RealScout account: read your contacts, their activity and your conversations, and, with `contacts:write`, change them. Treat it like a password.

## Never paste it into an AI chat

Don't paste your token into Claude, ChatGPT or any other chat. The token is kept in the chat's history and can't be taken back out. Don't put it in an email, a shared doc, a support ticket or a screenshot either.

If a token ever ends up somewhere it shouldn't, revoke it on the API Tokens page and create a new one. Revoking takes effect immediately.

## Store it in an environment variable

AI coding tools such as Claude Code, Cursor and Codex can read your token from an environment variable named `REALSCOUT_API_TOKEN`, so you never have to type it into the tool.

### Mac

1. Open Terminal and run `open -e ~/.zshrc`. If it says the file doesn't exist, run `touch ~/.zshrc` first.
2. Add this line, with your token in place of `your-token`:

   ```bash
   export REALSCOUT_API_TOKEN="your-token"
   ```

3. Save the file, then quit and reopen Terminal and your AI tool.
4. To check it worked, run `[ -n "$REALSCOUT_API_TOKEN" ] && echo set`. It prints `set` without showing the token.

### Windows

1. Open the Start menu and search for **Edit environment variables for your account**.
2. Under **User variables**, click **New...**.
3. Enter `REALSCOUT_API_TOKEN` as the name and your token as the value, then click **OK**.
4. Quit and reopen your AI tool.
5. To check it worked, open PowerShell and run `if ($env:REALSCOUT_API_TOKEN) { 'set' }`.

### Claude Code only

Claude Code can also take the variable from its own settings file, so no other program sees it. Add this to `~/.claude/settings.json` (on Windows, `%USERPROFILE%\.claude\settings.json`):

```json
{ "env": { "REALSCOUT_API_TOKEN": "your-token" } }
```

Each of these stores the token as plain text that only your user account can read. That keeps it out of chats, but anything running as you can still read it.

## Give each tool its own token

Create a separate token for each tool or script, and grant only the scopes it needs. A tool that only reads your contacts doesn't need `contacts:write`. Separate tokens mean you can revoke one without breaking the others, and every call is recorded against the token that made it.