---
title: "List personal access tokens (prefix only, never secrets)"
method: GET
path: "/api/v0/tokens"
tags: ["Auth"]
---

# List personal access tokens (prefix only, never secrets)

`GET /api/v0/tokens`

## Request

- Base URL: `https://app.vibeflow.tools`
- URL: `https://app.vibeflow.tools/api/v0/tokens`
- Auth: HTTP bearer

Plan §4.5 account endpoint (not a §1.2 task-surface row, hence planRow 0): cloud-only, no local handler — token management is online-only. Returns rows with prefix, name, scopes, lastUsedAt, expiresAt, revokedAt.

## Response `200`

List personal access tokens (prefix only, never secrets) — success

- TokenList
  - `tokens` Token[], required
    - `id` string, required
    - `name` string, required
    - `prefix` string, required: Display prefix, e.g. vbf_pat_9f2c…
    - `scopes` string[], required
    - `lastUsedAt` string, date-time, nullable
    - `expiresAt` string, date-time, nullable
    - `revokedAt` string, date-time, nullable
    - `createdAt` string, date-time

## Other responses

- `401`: Missing or invalid principal
- `403`: Lacking scope or membership
- `429`: Rate limited — cloud per-token quota exceeded (reads 300/min, writes 60/min, token creation 10/hour); counters are per-replica, so the effective limit is the configured value × replicas. The response carries Retry-After.

---

[API](https://skmtc.dev/vibeflow/apis/vibeflow-api-v0.md) · [All operations](https://skmtc.dev/vibeflow/apis/vibeflow-api-v0/llms.txt) · [OpenAPI document](https://skmtc.dev/vibeflow/apis/vibeflow-api-v0/revisions/efd4ba944b0b?raw)