---
title: Make your first API request
description: Create a personal access token and call the Bolder v2 API with curl or bolder-api-client.
---

Goal: read your shop's products through the v2 API. A personal access token (PAT) is the fastest way to authenticate scripts and tools that act on your own account. To act for other merchants, [register an app](/guides/build-an-app) instead.

1. **Create a token**

    Go to [start.onbolder.com/dev/credentials](https://start.onbolder.com/dev/credentials) and sign in. Under **Personal Access Tokens**, create a token: give it a name, pick an expiry (30 days, 90 days, 1 year or none) and the [scopes](/api/v2) it needs. For this guide, `products.read` is enough. You can only grant scopes your own user role has.

    The token is shown **once**. Copy it and keep it out of your repository:

    ```bash
    export BOLDER_TOKEN=PASTE_YOUR_TOKEN_HERE
    ```

2. **Call the API root**

    The token goes in the `Authorization` header; v2 does not accept tokens in the query string.

    ```bash
    curl -H "Authorization: Bearer $BOLDER_TOKEN" https://api.onbolder.com/v2
    ```

    The root answers with HAL `_links` to the resources the token can reach. Clients should follow those links rather than build URLs.

3. **List products**

    ```bash
    curl -H "Authorization: Bearer $BOLDER_TOKEN" "https://api.onbolder.com/v2/products?per_page=5"
    ```

    The products are in `_embedded.products`; `page`, `per_page`, `total_items` and `total_pages` are at the top level.

4. **Do the same from JavaScript**

    [`bolder-api-client`](https://www.npmjs.com/package/bolder-api-client) is a small fetch wrapper over the v2 API (Node 18+ or any runtime with `fetch`):

    ```bash
    npm install bolder-api-client
    ```

    ```js
    import { createBolder } from 'bolder-api-client'

    const bolder = await createBolder({ token: process.env.BOLDER_TOKEN })

    const res = await bolder.products.list({ per_page: 5 })
    for (const product of res._embedded.products) {
      console.log(product.id, product.title)
    }
    ```

    `createBolder()` fetches the API root once and resolves `bolder.products.list()` and `bolder.orders.list()` from its links. For any other endpoint use `bolder.client.get|post|put|patch|delete(path, body?)`, with paths relative to `https://api.onbolder.com/v2`. A failed request throws an `ApiError` with `status` and the response `body`.

## Revoking a token

PATs have no refresh flow: they are valid until their expiry or until you revoke them on the same credentials page. Revoking takes effect immediately.

## Next

- [Create an order and take payment](/guides/create-an-order)
- [Script your shop with the CLI](/cli#custom-scripts): `bolder run` hands your script an authenticated client.
- [API v2 reference](/api/v2): pagination, errors and HTTP caching.