---
title: "List the caller’s tokens (no plaintext, no hash)"
method: GET
path: "/api/token"
---

# List the caller’s tokens (no plaintext, no hash)

`GET /api/token`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/api/token`
- Auth: HTTP bearer

Returns the caller's personal access token metadata: stable `id`, public `tokenPrefix`, optional `label`, `expiresAt`, last-used timestamp, and `createdAt`. Plaintext and hashed values are never echoed — store the plaintext returned by `POST /api/token`; if it's lost, revoke and mint a new one.

## Response `200`

Tokens

- TokenListResponse: List of the caller's personal access tokens.
  - `tokens` TokenInfo[], required
    - `id` string, uuid, required
    - `tokenPrefix` string, required
    - `label` string, nullable
    - `expiresAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable
    - `createdAt` string, date-time, required

## Other responses

- `401`: User-scoped auth required to list tokens.

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)