---
title: "List all tokens"
method: GET
path: "/oauth2/tokens"
tags: ["OAuth2"]
---

# List all tokens

`GET /oauth2/tokens`

## Request

- Base URL: `https://api.payware.eu`
- URL: `https://api.payware.eu/oauth2/tokens`
- Auth: HTTP bearer

Returns the OAuth2 authorization tokens of the authenticated ISV, one per merchant authorization in any status. A merchant that has been deleted is not listed: its authorization is revoked with it, and the ISV is told by the merchant.deleted callback.

## Response `200`

List of tokens

## Other responses

- `401`: Unauthenticated - missing, malformed or expired credentials
- `403`: Forbidden - the caller is authenticated but not permitted (plan or capability gate, KYC state, or tenant scope)
- `404`: Caller is not an ISV
- `429`: Too many requests - the caller exceeded its per-partner rate limit. Carries errorCode ERR_RATE_LIMIT_EXCEEDED and a Retry-After header, in seconds. The request was not processed, so the identical request is safe to retry once the window has passed.

---

[API](https://skmtc.dev/payware/apis/payware-api.md) · [All operations](https://skmtc.dev/payware/apis/payware-api/llms.txt) · [OpenAPI document](https://skmtc.dev/payware/apis/payware-api/revisions/7b3352ca947b?raw)