---
title: "List the caller's active agent tokens"
method: GET
path: "/api/tokens/me"
tags: ["auth", "browser-session"]
---

# List the caller's active agent tokens

`GET /api/tokens/me`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/tokens/me`
- Auth: API key in cookie `__session`

Clerk-session only, DELIBERATELY not dual-auth: an agent reading 'all my tokens' would be a side-channel for post-revocation persistence, so the list is browser-only. Revoked tokens are filtered out and no token plaintext or public-key material is returned. Read-only — revocation happens at /floor10/agent-console or POST /api/agent/token/revoke.

## Response `200`

Active tokens, newest first.

- TokensMeResponse
  - `ok` boolean, required
  - `count` integer, required
  - `tokens` AgentTokenPublic[], required
    - `sha256` string, required: Stable id of the token; also how activity rows are attributed.
    - `prefix` string, required: First characters of the token, enough to recognize it.
    - `label` string
    - `scopes` string[], required
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time
    - `revoked` boolean: Always false in this list — revoked tokens are filtered out.
    - `has_pubkey` boolean: True iff a usable Web-Bot-Auth key is bound.
    - `requires_signature` boolean: Only ever true alongside has_pubkey.
    - `key_id` string: Only present alongside has_pubkey.

## Other responses

- `401`: Not signed in.
- `503`: Clerk backend unreachable.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)