token

Interfaces

CreateTokenData

Properties

Property	Type	Description
`expiresAt?`	`string` \| `null`	Optional ISO date. Null / omitted = non-expiring.
`name`	`string`	Customer-facing label. 1–80 characters.
`scopes`	`TokenScope`[]	At least one scope. The server rejects unknown scopes.

The shape returned by listTokens and (without the token field) the metadata half of createToken. Never includes the raw secret — that is shown exactly once at creation time and is the caller's responsibility to capture.

Extends

TokenSummary

Properties

Property	Type	Description	Inherited from
`createdAt`	`string`	-	`TokenSummary`.`createdAt`
`expiresAt?`	`string` \| `null`	-	`TokenSummary`.`expiresAt`
`id`	`string`	-	`TokenSummary`.`id`
`kind`	`TokenKind`	-	`TokenSummary`.`kind`
`lastUsed?`	`string` \| `null`	-	`TokenSummary`.`lastUsed`
`name`	`string`	-	`TokenSummary`.`name`
`prefix`	`string`	-	`TokenSummary`.`prefix`
`scopes`	`TokenScope`[]	-	`TokenSummary`.`scopes`
`token`	`string`	The raw secret. Returned ONLY in this response. The server keeps a one-way hash and cannot recover this value — the customer must capture it immediately (typical pattern: reveal-once modal with a copy button).	-

TokenSummary

Extended by

CreateTokenResponse

Properties

Property	Type
`createdAt`	`string`
`expiresAt?`	`string` \| `null`
`id`	`string`
`kind`	`TokenKind`
`lastUsed?`	`string` \| `null`
`name`	`string`
`prefix`	`string`
`scopes`	`TokenScope`[]

Type Aliases

TokenKind

type TokenKind = "pat" | "oauthAccess" | "oauthRefresh" | "botAccess";

Personal Access Token kinds. v1 only mints pat; the rest are reserved for the future OAuth grant flow and are listed here so callers can switch on the kind.

TokenScope

type TokenScope = 
  | "chat:read"
  | "chat:write"
  | "tasks:read"
  | "tasks:write"
  | "assets:read"
  | "assets:write"
  | "projects:read"
  | "workspaces:read";

Granted action verbs on a token. The server validates requested scopes against this set. Fall back to string in your own code if it accepts arbitrary scopes from configuration.

Functions

default()

function default(client): {
  createToken: Promise<CreateTokenResponse>;
  deleteToken: Promise<void>;
  listTokens: Promise<TokenSummary[]>;
};

Personal Access Token surface — auth-gated, owner-scoped. Any logged-in user can mint, list, and revoke their own tokens; there is no admin-on-behalf surface here (admins managing bot keys do that via the bot methods).

Parameters

Parameter	Type
`client`	`default`

Returns

Name	Type	Description
`createToken()`	(`data`) => `Promise`<`CreateTokenResponse`>	Mint a new Personal Access Token for the calling user. The raw secret is in the response's `token` field — store it immediately, it cannot be retrieved again.
`deleteToken()`	(`tokenId`) => `Promise`<`void`>	Revoke one of the caller's Personal Access Tokens. The revocation is immediate — the token will return 401 on the very next request.
`listTokens()`	() => `Promise`<`TokenSummary`[]>	List the caller's Personal Access Tokens. Bot-access keys held by the same user (rare but possible — admin who's also a bot owner) are filtered out server-side and surface via the bot management screens instead.

On this page