# API & delegate tokens

Minted in [Agents & API](/tests/app/tokens). Raw tokens are shown **once** and
stored hashed — treat them like passwords, revoke them any time.

## API tokens (`atk_…`)

Full-scope by default, no expiry. For your own agents and scripts. Scopes can
be narrowed at mint: `bank:read`, `bank:write`, `tests:read`, `tests:write`,
`results:read`, `results:write`, `send`.

## Delegate tokens (`adt_…`)

For **someone else** — a colleague, a typing service, or our team doing
assisted entry. Defaults: question-bank scopes only, 7-day expiry, 500
requests. Minting one gives you a ready-to-forward message; the delegate (or
their agent) uses it exactly like an API token, and:

- every question it adds is **stamped with the token** — you always know what
  came from whom;
- it cannot see results, publish tests, or email students;
- the first user binds it (`X-Delegate-Email` header identifies them); it
  stops at expiry, use-cap, or the moment you revoke it.

## Too busy to type questions?

Mail your question paper to the address on your dashboard and our team will
load it for you using exactly this mechanism — a 3-day delegate token minted
against your account, every insertion attributable.