---
title: "List your API tokens"
method: GET
path: "/api/tokens"
tags: ["API Tokens"]
---

# List your API tokens

`GET /api/tokens`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/tokens`
- Auth: HTTP bearer

Returns all API tokens for the authenticated user. Keys are masked for security (first 12 + last 4 characters visible). Use this to audit active tokens.

## Response `200`

List of API tokens

- object
  - `tokens` TokenInfo[]
    - `id` string, required: Unique token identifier (use this for DELETE)
    - `name` string, required: Human-readable token label
    - `key` string, required: Masked API key (full key shown only on creation)
    - `lastUsed` string, date-time, nullable: Last time this token was used
    - `expiresAt` string, date-time, nullable: When this token expires (null = never)
    - `expired` boolean: Whether this token has expired
    - `scopes` string[], required: Permission scopes granted to this token. ['*'] means full access.
    - `createdAt` string, date-time, required
    - `max_per_tx` number, nullable: Per-transaction spend cap in USD (null = uncapped)
    - `max_per_month` number, nullable: Rolling monthly spend cap in USD (null = uncapped)
    - `spent_this_month` number: USD spent against the monthly cap this calendar month
    - `parent_token_id` string, nullable: Id of the token that minted this one (null = created via dashboard/session)
    - `mailbox_ids` string[], required: Mailbox ids this token is confined to. Empty means no mailbox-id confinement.
    - `http_route_policy` HttpRoutePolicy, nullable, required: Structured hostname, concurrency, and lease authority for a least-privilege HTTP route token.
      - `hostname_rules` union[], required
        - union
          - object
            - `domain` string, required
            - `kind` 'exact', required
            - `hostname` string, required
          - object
            - `domain` string, required
            - `kind` 'subdomain_prefix', required
            - `prefix` string, required
      - `max_concurrent` integer, required
      - `max_lease_seconds` integer, required
    - `agent_identity` object, nullable: Agent identity represented by this token. Its mail actions are attributed to this agent.
      - `id` string
      - `name` string, nullable
      - `slug` string

## Other responses

- `401`: Missing or invalid API key
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)