@archastro/sdk
    Preparing search index...

    Class TokenResource

    Index

    Constructors

    constructor

    Methods

    create delete list

    Constructors

    Methods

    • Create a personal access token Issues a new long-lived access token for the authenticated user. The raw JWT is returned in the token field of the response exactly once and cannot be retrieved again — store it securely immediately after creation. scopes is optional. When omitted the token receives full_access. Known catalog scopes (for example profile) restrict the token through the same ScopeGuard used by OAuth. expires_in_days is optional and must be one of 7, 30, 60, 90, or 365. When omitted the token lasts 30 days. Each user may hold at most 50 active tokens; exceeding that limit returns 429. The caller must be the user identified by user and must present a first-party session (or a full_access access token). A restricted access token cannot mint another token.

      Parameters

      • user: string

        User ID (usr_...) or me for the authenticated user.

      • input: { expires_in_days?: number; name?: string; scopes?: string[] }

        Request body.

        • Optionalexpires_in_days?: number

          Lifetime in days. One of 7, 30, 60, 90, or 365. Defaults to 30.

        • Optionalname?: string

          Human-readable label for the token (e.g. "Codex MCP"). Stored as metadata only.

        • Optionalscopes?: string[]

          Optional OAuth scopes to stamp on the token. Omit for full_access.

      Returns Promise<SystemAccessToken>

      The newly created access token. The token field contains the raw JWT and is present only in this response — it is not stored and cannot be retrieved later.

    • Revoke a personal access token Permanently revokes the specified access token belonging to the authenticated user. Once revoked, the token is immediately rejected by all API endpoints and cannot be reinstated. The token record is retained and returned in the response with revoked_at populated. The caller must be the user identified by user and must present a first-party session (or a full_access access token). Returns 404 if the token does not exist or does not belong to the caller.

      Parameters

      • user: string

        User ID (usr_...) or me for the authenticated user.

      • token: string

        Access token ID (sat_...). Must belong to the authenticated user.

      Returns Promise<SystemAccessToken>

      The revoked access token. The revoked_at field is populated with the time of revocation.

    • List personal access tokens Returns all access tokens associated with the authenticated user, including active and revoked tokens. Tokens are returned without their raw JWT values — the plaintext JWT is only available at creation time. The caller must be the user identified by user and must present a first-party session (or a full_access access token).

      Parameters

      • user: string

        User ID (usr_...) or me for the authenticated user.

      Returns Promise<
          {
              data: {
                  created_at?: string;
                  created_by_agent_user?: string
                  | null;
                  created_by_developer?: string | null;
                  created_by_org?: string | null;
                  created_by_team?: string | null;
                  created_by_user?: string | null;
                  expires_at?: string | null;
                  id: string;
                  last_used_at?: string | null;
                  name?: string | null;
                  revoked_at?: string | null;
                  scopes?: string | null;
                  token?: string;
              }[];
          },
      >

      Successful response

    Settings

    Member Visibility

    On This Page

    Constructors
    Methods