> ## Documentation Index
> Fetch the complete documentation index at: https://docs.co-mind.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# 9. Manage tokens

> List, rotate, and revoke your Personal Access Tokens. Token management uses your session JWT, not the PAT itself.

Now that the walkthrough is done, take a moment to review the PATs on your account. Token management endpoints require a **session JWT** — a PAT can't manage other PATs. If the JWT from step 1 has expired (they last one hour), sign in again first.

## List your tokens

Secrets are never returned again — only metadata:

```bash theme={null}
curl {BASE_URL}/v1/api-tokens \
  -H "Authorization: Bearer $JWT"
```

```json theme={null}
[
  {
    "id": "abc123",
    "name": "walkthrough-token",
    "scopes": ["chat:write", "models:read", "..."],
    "created_at": "2026-09-02T12:34:56Z",
    "expires_at": "2026-10-02T12:34:56Z",
    "last_used_at": "2026-09-02T13:12:00Z",
    "is_expired": false,
    "is_revoked": false
  }
]
```

## Rotate a token

New secret, same id and scopes. The old secret is invalidated immediately:

```bash theme={null}
curl -X POST {BASE_URL}/v1/api-tokens/abc123/rotate \
  -H "Authorization: Bearer $JWT"
```

The response has the same shape as the create response — including the one-time `token` field. Save it before it scrolls out of your terminal.

## Revoke a token

Idempotent — revoking an already-revoked token is a no-op:

```bash theme={null}
curl -X DELETE {BASE_URL}/v1/api-tokens/abc123 \
  -H "Authorization: Bearer $JWT"
```

## Limits

* Up to 25 active tokens per user
* Up to 365 days per token
* Names must be unique among your active tokens

## What's next

* **Full endpoint catalog** — [Developer Guide](/guides/developer-guide)
* **Interactive API reference** — [API Reference](/api-reference/introduction)
* **Release notes** — [Changelog](/changelog/release-notes)
* **No-code automation** — the [n8n integration](/integrations/n8n) uses the same API from workflow nodes.