---
title: "List this account's API tokens (metadata only; token values are never returned after mint)."
method: GET
path: "/v1/tokens"
tags: ["tokens"]
---

# List this account's API tokens (metadata only; token values are never returned after mint).

`GET /v1/tokens`

## Request

- Base URL: `https://api.kody.codes`
- URL: `https://api.kody.codes/v1/tokens`
- Auth: HTTP bearer

List this account's API tokens (metadata only; token values are never returned after mint). Tokens require an explicit lifetime: lifetime "short" (3600s idle / 86400s max) or "long" (1209600s idle / 7776000s max), or both idle_ttl_seconds (60-1209600) and max_lifetime_seconds (up to 7776000). Each successful request slides expires_at forward, never past max_expires_at. At most 500 active tokens per account; a new mint reclaims the active token(s) with the least remaining life (sooner of idle deadline and absolute expiry), never the caller's own token.

Org permission: `token:read`.

## Query parameters

- `include_inactive` boolean: Include expired and revoked tokens (kept for 7 days).

## Response `200`

Success.

- object
  - `tokens` object[], required
    - `id` string, required
    - `name` string, required
    - `org_id` string, required: For org-bound tokens: the fixed org id. For user-owned tokens: the personal org id (placeholder; each request picks an org via `?org=`).
    - `org_binding` 'org' | 'user', required: `org`: fixed to org_id. `user`: person-owned; pass `?org=<slug>` on each request (default personal org). Membership/grants are checked live.
    - `scopes` string[], required
    - `status` 'active' | 'expired' | 'revoked', required
    - `idle_ttl_seconds` integer, required
    - `expires_at` string, required: Sliding expiry. Each successful request pushes it forward.
    - `max_expires_at` string, required: Absolute expiry. The token never outlives it.
    - `created_via` string, required
    - `created_at` string, required
    - `last_used_at` string, nullable, required
    - `rotated_at` string, nullable, required
    - `revoked_at` string, nullable, required
    - `profile_name` string, nullable, required: Named connection profile this token is bound to, or null for unlimited.

## Other responses

- `400`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `401`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `403`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `404`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `409`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `413`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying.
- `500`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `503`: Error envelope `{ "error": { "code", "message", "details"? } }`.
- `default`: Error envelope `{ "error": { "code", "message", "details"? } }`.

---

[API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/a020ecedb82b?raw)