---
title: "List app tokens"
method: GET
path: "/oauth-clients/{appId}/tokens"
tags: ["OAuth Apps"]
---

# List app tokens

`GET /oauth-clients/{appId}/tokens`

Lists active access and refresh tokens currently issued to an OAuth app, sorted newest first. Useful for auditing app usage and picking specific tokens to investigate before a targeted revocation.

Each entry includes the token type (`access` or `refresh`), the user the token was issued for (omitted for client-credentials access tokens), the granted scopes, the issuance and expiry timestamps, and the revocation flag. Each type is capped at 100 most-recent rows server-side (`listTokensForApp` in `oauth_token.service.ts`); revoked and expired tokens are excluded.

Creator-only.

## Path parameters

- `appId` string, required

## Response `200`

List of tokens

- OAuthAppTokensListResponse — Response body for `GET /oauth-clients/{appId}/tokens` (`listAppTokens`).
  - `tokens` OAuthTokenListItem[], required — Active access and refresh tokens for the app
    - `id` string, required — Token ID
    - `tokenType` 'access' | 'refresh', required — Type of token
    - `userId` string — User ID (omitted for client-credentials access tokens)
    - `scopes` string[], required — Granted scopes
    - `createdAt` string, date-time, required — Token creation time
    - `expiresAt` string, date-time, required — Token expiration time
    - `isRevoked` boolean, required — Whether token has been revoked

## Other responses

- `401` — Unauthorized
- `403` — Forbidden — caller cannot access this OAuth app (creator-only; see OAuth Apps tag).
- `404` — OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/revisions/64bfe76b130e/schema)