---
title: "List your API tokens"
method: GET
path: "/v1/account/tokens"
tags: ["Account"]
---

# List your API tokens

`GET /v1/account/tokens`

## Request

- Base URL: `https://nanostudiopro.com/api`
- URL: `https://nanostudiopro.com/api/v1/account/tokens`
- Auth: HTTP bearer

Returns every Personal Access Token attached to the caller's account, including expired and revoked ones, sorted by creation date. The hashed token value is never returned — only the `token_prefix` (visible to humans for recognition). The token currently authenticating this request is marked `is_current: true`.

## Response `200`

Token list.

- object
  - `items` object[]
    - `id` string
    - `name` string
    - `token_prefix` string
    - `scopes` string[]
    - `last_used_at` string, date-time, nullable
    - `created_at` string, date-time
    - `expires_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
    - `daily_credit_cap` integer, nullable
    - `source` string: `manual` (created in settings) | `device_flow` (issued through OAuth device authorization) | `oauth` (issued to a connected app via the OAuth authorization-code flow)
    - `user_agent` string, nullable
    - `oauth_app_id` string, nullable
    - `token_type` 'secret' | 'publishable': `secret` (sk_sf_live_, full API) | `publishable` (pk_sf_live_, embeddable, search-only).
    - `search_scope` SearchScope: Per-key narrowing carried by publishable (`pk_sf_live_`) keys. Every field is optional; an absent field means no restriction on that axis. Enforcement is silent — filters outside the scope produce an empty 200 page, oversized `image_size` requests are served the cap, and `include_regions` is ignored unless allowed. The one hard rejection is `origins`: a browser request from an origin not on the list gets `403 forbidden`.
      - `projects` string[]: The key sees ONLY these project ids. Absent = the whole library.
      - `types` string[]: Result types the key may return. Absent (or both) = no restriction.
      - `max_image_size` 'xs' | 'thumb' | 'preview' | 'large' | 'original': Largest `image_size` variant the key may be served. Requests above it — the `preview` default included — are silently clamped down to this rung.
      - `origins` string[]: Exact-match browser `Origin` allowlist. Entries must be bare http(s) origins (no path, no default port). Absent = any origin. Requests with no Origin header (curl, server-to-server) always pass.
      - `include_regions` boolean: Whether the key may request detection regions via `include_regions=true`. Default false — the request flag is silently ignored without it.
      - `include_narrative` boolean: Whether results carry `narrative` (the AI-written photo description). Default false — publishable-key results omit the field unless the scope opts in. Secret keys always get it.
    - `is_current` boolean

## Other responses

- `401`: Missing or invalid token
- `429`: Rate limit exceeded

---

[API](https://skmtc.dev/nanostudiopro/apis/nano-studio-pro-api.md) · [All operations](https://skmtc.dev/nanostudiopro/apis/nano-studio-pro-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nanostudiopro/apis/nano-studio-pro-api/revisions/b454211e598e?raw)