Skip the auto-login flow. Paste your session token (used for private-API tools); the DoorLoop API token (used for /api/* CRUD) is auto-detected from it — leave it blank unless your account has no API key yet. Useful if MFA, AWS WAF, or anti-bot challenges block the headless sign-in.
Where to find the session token: Log in to DoorLoop. Open DevTools → Network → click any request to app.doorloop.com/api/.... Under Request Headers, copy the full token=... cookie value when possible (everything between token= and the next ;); this also seeds automatic browser refresh. A raw tokenId header works for API calls but cannot seed the browser cookie.
API token (optional): auto-detected from your session. Only if your account has no key yet — DoorLoop → Settings → Zapier & API Keys → Create new key, copy the secret (shown once).