API tokens let scripts and integrations authenticate as you without using your password. Tokens are shown once at creation — store them securely. Use Authorization: Bearer <token> in your requests.