9. Manage tokens - co-mind.ai

Now that the walkthrough is done, take a moment to review the PATs on your account. Token management endpoints require a session JWT — a PAT can’t manage other PATs. If the JWT from step 1 has expired (they last one hour), sign in again first.

List your tokens

Secrets are never returned again — only metadata:

curl {BASE_URL}/v1/api-tokens \
  -H "Authorization: Bearer $JWT"

[
  {
    "id": "abc123",
    "name": "walkthrough-token",
    "scopes": ["chat:write", "models:read", "..."],
    "created_at": "2026-09-02T12:34:56Z",
    "expires_at": "2026-10-02T12:34:56Z",
    "last_used_at": "2026-09-02T13:12:00Z",
    "is_expired": false,
    "is_revoked": false
  }
]

Rotate a token

New secret, same id and scopes. The old secret is invalidated immediately:

curl -X POST {BASE_URL}/v1/api-tokens/abc123/rotate \
  -H "Authorization: Bearer $JWT"

The response has the same shape as the create response — including the one-time token field. Save it before it scrolls out of your terminal.

Revoke a token

Idempotent — revoking an already-revoked token is a no-op:

curl -X DELETE {BASE_URL}/v1/api-tokens/abc123 \
  -H "Authorization: Bearer $JWT"

Limits

Up to 25 active tokens per user
Up to 365 days per token
Names must be unique among your active tokens

What’s next

Full endpoint catalog — Developer Guide
Interactive API reference — API Reference
Release notes — Changelog
No-code automation — the n8n integration uses the same API from workflow nodes.