---
title: "List app tokens"
method: GET
path: "/oauth-clients/{appId}/tokens"
tags: ["OAuth Apps"]
---

# List app tokens

`GET /oauth-clients/{appId}/tokens`

## Request

- Base URL: `https://app.pipeshub.com/api/v1`
- URL: `https://app.pipeshub.com/api/v1/oauth-clients/{appId}/tokens`
- Auth: HTTP bearer

Lists active access and refresh tokens currently issued to an OAuth app, sorted newest first. Useful for auditing app usage and picking specific tokens to investigate before a targeted revocation.

Each entry includes the token type (`access` or `refresh`), the user the token was issued for (omitted for client-credentials access tokens), the granted scopes, the issuance and expiry timestamps, and the revocation flag. Each type is capped at 100 most-recent rows server-side (`listTokensForApp` in `oauth_token.service.ts`); revoked and expired tokens are excluded.

Creator-only.

## Path parameters

- `appId` string, required

## Response `200`

List of tokens

- OAuthAppTokensListResponse: Response body for `GET /oauth-clients/{appId}/tokens` (`listAppTokens`).
  - `tokens` OAuthTokenListItem[], required: Active access and refresh tokens for the app
    - `id` string, required: Token ID
    - `tokenType` 'access' | 'refresh', required: Type of token
    - `userId` string: User ID (omitted for client-credentials access tokens)
    - `scopes` string[], required: Granted scopes
    - `createdAt` string, date-time, required: Token creation time
    - `expiresAt` string, date-time, required: Token expiration time
    - `isRevoked` boolean, required: Whether token has been revoked

## Other responses

- `400`: `appId` is not a 24-character hex id (`VALIDATION_ERROR` naming `params.appId`) Also returned, before authentication, when a query value, or any string in a JSON or form-encoded body, looks like markup to the app-wide XSS filter: an HTML tag, a script tag, `<iframe`, `<object`, `<embed` or `<svg` tag, a word starting with `on` followed by `=` (meant for inline event handlers such as `onerror=`, it also catches plain text such as `one=1`), a `javascript:` or `data:text/html` URL, an encoded script tag (`&lt;script`, `%3cscript`), or any string longer than 100,000 characters (`HTTP_BAD_REQUEST`, "HTML tags, scripts, and XSS content are not allowed in ...", naming the field or query parameter; a string over 100,000 characters is refused as too long instead). A JSON body that does not parse is refused the same way, also before authentication (`HTTP_BAD_REQUEST`, "The request body is not valid JSON.").
- `401`: Unauthorized
- `403`: Bearer token is an OAuth access token or personal access token rather than a user session, or the caller is a service account. An app the caller did not create is 404, not 403.
- `404`: OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429`: Rate limit exceeded
- `500`: Internal server error. A JSON body larger than 10 MB, or a form-encoded body larger than 100 KB or with more than 1000 fields, is answered `413` by the app-wide body parsers instead, also before authentication.

## Changes

- **2026-10-28** `dbb5e203b445`: 5 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `500`
  - added the optional property `error/requestId` to the response with the `401` status
  - added the optional property `error/requestId` to the response with the `403` status
  - …1 more

[Operation history](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/changes/oauth-clients/:appId/tokens/get.md)

---

[API](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api.md) - [All operations](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/revisions/dbb5e203b445?raw)