Tokens API

Retrieves a list of all active API tokens for the authenticated user. Excludes the actual token strings for security; only returns metadata.

curl -H "Cookie: session-cookie-here" \
  "http://localhost:3000/api/tokens"

[
  {
    "id": "uuid-123",
    "name": "My Desktop Integration",
    "createdAt": "2024-03-26T12:00:00.000Z",
    "lastUsedAt": "2024-03-27T15:30:00.000Z"
  }
]

Generates a new API token. The actual token string (starting with nlk_) is returned exactly once in the response body. It cannot be retrieved again.

curl -X POST http://localhost:3000/api/tokens \
  -H "Cookie: session-cookie-here" \
  -H "Content-Type: application/json" \
  -d '{"name":"Zapier Workflow"}'

{
  "id": "new-uuid",
  "userId": "user-123",
  "name": "Zapier Workflow",
  "token": "nlk_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
  "createdAt": "2024-03-26T12:05:00.000Z",
  "lastUsedAt": null
}

Revokes and deletes a specific API token immediately. Any active integrations using this token will start returning 401 Unauthorized.

curl -X DELETE "http://localhost:3000/api/tokens/uuid-123" \
  -H "Cookie: session-cookie-here"