# Obtain a Token from the Dashboard

API7 Gateway uses Dashboard-created tokens for authenticated access. Across the docs, the same token can be used as the `X-API-KEY` value in API7 Gateway Admin API requests or as `ADC_TOKEN` when using ADC.

For routine API access, sign in with a non-root user and create a token for that user instead of using the initial `Super Admin` account.

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

Before you begin, ensure you have:

* API7 Gateway is running and the Dashboard is accessible.
* You have a non-root user account with the permissions required for the resources you want to manage.

If you only have the initial administrator account, sign in as `Super Admin` first to create or invite a user and assign the required role. Then sign in with that user to create the token. For details, see [User Management](https://docs.api7.ai/api7-gateway/configure-and-manage/user-management.md) and [Role-Based Access Control](https://docs.api7.ai/api7-gateway/security-and-compliance/role-based-access-control.md).

## Create a Token in the Dashboard[​](#create-a-token-in-the-dashboard "Direct link to Create a Token in the Dashboard")

1. Sign in to the Dashboard with your non-root user account.
2. In the sidebar, navigate to **Organization** -> **Tokens**.
3. Click **Create Token**.
4. Enter a name and any other required settings.
5. Copy the generated token and store it securely.

## Use the Token[​](#use-the-token "Direct link to Use the Token")

Set the token as an environment variable for Admin API examples:

```
export API_KEY="a7ee-xxxxxxxxxxxxx"
```

Use it in API7 Gateway Admin API requests:

If you are not running locally, replace `localhost` with your Dashboard or Admin API host.

```
curl -k "https://localhost:7443/api/users" -X GET \

  -H "X-API-KEY: ${API_KEY}"
```

You can use the same token for:

* API7 Gateway Admin API requests under `/api/*` and `/apisix/admin/*`
* ADC authentication as `ADC_TOKEN`

## Security Notes[​](#security-notes "Direct link to Security Notes")

* Treat the token like a password and do not commit it to source control.
* Create separate tokens for different users or automation workflows when possible.
* Revoke tokens you no longer need.