Get tokens for corresponding user and tenant

Returns the full list of tokens for the current user and tenant. Tokens are scoped to the authenticated caller. This endpoint only returns tokens belonging to the user associated with the API key making the request, not tokens for other users in the tenant. Use this endpoint to locate the id of a specific token for use with the renew (PUT) or delete (DELETE) endpoints.

Use this endpoint to audit active API keys, identify keys approaching expiry, or retrieve token IDs for renewal or deletion.

About Get Personal Access Tokens

Returns the full list of personal access tokens for the current user and tenant. Personal access tokens are scoped to the authenticated caller. This endpoint only returns API keys belonging to the user associated with the API key making the request, not those belonging to other users in the tenant. Use this endpoint to locate the id of a specific token for use with the renew (PUT) or delete (DELETE) endpoints.

Key Fields (Response)

id — the UUID of the token record; use with PUT and DELETE /authn2/v0/personal-access-token/{personal_access_token_id}

name — the human-readable label assigned at creation

description — the description assigned at creation

prefix — a short prefix of the API key; use this to identify which key corresponds to a known credential without exposing the secret

expiry_at — the expiry as a Unix timestamp; -1 indicates no expiry

created_at / updated_at — timestamps for the token record

legacy_token_id / legacy_developer_app_id — references to the legacy token system, if applicable

Common Use Cases

Auditing which API keys are active for the current user

Identifying API keys approaching expiry so they can be renewed before they stop working

Retrieving the id of a specific token for renewal or deletion when the ID was not stored at creation time

Best Practices

Use prefix values to match list entries to known API keys in your secrets store — the full key value is never returned here

Regularly review expiry_at values and renew any API keys that will expire before your next maintenance window

Treat any token with a legacy_token_id as a migration candidate — consider replacing it with a new personal access token and retiring the legacy credential

Workflow

Call GET /authn2/v0/personal-access-token/ to retrieve all API keys for the current user

Identify the target token by name, prefix, or expiry_at

Use the token id with PUT .../personal-access-token/{personal_access_token_id} to renew, or DELETE to revoke