Docs
One header on every request, and one place to create or replace the token behind it.
Authorization: Bearer ytt_<your-token>Tokens start with ytt_ and are created on your account page. The whole token is shown once, at creation, and after that only its first characters, so store it when you make it. Creating a new one replaces the old one.
A token carries your account, which means it carries your minutes. A job queued with it appears in your library beside the ones you started in the browser.
Anything in a browser, a mobile app or a public repository is readable by whoever wants it, and a token that leaks spends your minutes. Call the API from your own backend and keep the token in an environment variable there. If one does get out, create a new token on the account page: that is what revokes the old one.
The token is missing, malformed or revoked. Send Authorization: Bearer ytt_<your-token>. Create or replace the token at /account/api/. The response also carries WWW-Authenticate: Bearer, and the body is {"detail": "..."}.
The MCP server at https://api.youtubetotext.ai/mcp signs you in through your account instead of a token, so an assistant you connect there does not need one. The MCP page has the setup for each client.