---
title: "List your own personal access tokens"
method: GET
path: "/personal-access-tokens"
tags: ["Personal Access Tokens"]
---

# List your own personal access tokens

`GET /personal-access-tokens`

Lists the caller's own active (non-revoked, unexpired) personal
access tokens, newest first, capped at 100 rows server-side. Never
returns another user's tokens — see `GET /personal-access-tokens/admin`
for the org-admin, cross-user view.

Shares the same per-user rate limiter as `/oauth-clients/*`
(default 1000 req/min, `MAX_OAUTH_CLIENT_REQUESTS_PER_MINUTE`).

## Response `200`

The caller's active personal access tokens

- ListPatResponse — Response body for `GET /personal-access-tokens` (`listTokens`) — the caller's own active tokens, capped at 100 most-recent server-side. Unlike the admin list, this is a flat array with no pagination envelope and no owner fields (it's implicitly scoped to the caller).
  - `tokens` PatListItem[], required
    - `id` string, required — Token ID
    - `name` string, required — Token name
    - `scopes` string[], required — Granted scopes
    - `createdAt` string, date-time, required
    - `expiresAt` string, date-time, required — Expiry timestamp. A `"never"`-expiry token is stored as a ~100-year-out date, not a literal null — treat anything decades out as "never" rather than a real deadline.
    - `lastUsedAt` string, date-time — Last time this token successfully authenticated a request. Throttled server-side to update at most once per 5 minutes per token; absent if the token has never been used.

## Other responses

- `401` — Unauthorized
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/revisions/64bfe76b130e/schema)