Create the token in the Typeform web app: Account -> Personal tokens -> Generate a new token; pick minimal scopes (forms:read/write, responses:read/write, webhooks:read/write, etc.).
The token (format tfp_...) is shown ONCE at creation — store it securely.
Send it on every request: curl https://api.typeform.com/me -H 'Authorization: Bearer {your_access_token}'
EU-provisioned accounts use a regional base domain for response data instead of api.typeform.com — docs reference both api.eu.typeform.com (existing EU DC) and api.typeform.eu (newer EU DC). Derive the right domain from your account's returned response URLs rather than hardcoding.
Scopes are enforced per token: forms:write also covers deleting forms, responses:write also covers deleting responses — scope narrowly.
Official docs: https://www.typeform.com/developers/get-started/personal-access-token/ ; https://www.typeform.com/developers/get-started/responses-data-center/ ; https://www.typeform.com/developers/get-started/scopes/
Known gotchas
Querying the wrong regional domain for an EU-configured account returns nothing (empty results) rather than an error — a silent failure mode.
Tokens cannot be re-viewed after creation, only regenerated.
The Bearer header syntax is documented on the get-started/hands-on page, not on the personal-access-token page itself.
Give your agent this knowledge — and 18,100+ more routes
One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?