Every endpoint on this page requires the master API key in the key request header. Bearer tokens cannot be used to create or manage tokens.
Use a created token on other protected endpoints with Authorization: Bearer <token>. The full token value is returned only when it is created; store it securely because it cannot be retrieved later.
Creates a scoped bearer token. expiresAt is optional; omit it or use null for a token that does not expire.
Body
{
"name": "Train board reader",
"permissions": ["trains:read", "fido.trainClaims:read"],
"expiresAt": "2026-12-31T23:59:59Z"
}Permission format
Use "*" to grant all access, or "<resource>:<read|write|*>". For example, trains:read grants read access to the trains resource, and fido:write covers FIDO endpoints.
Response (201 Created)
{
"id": "66d123456789abcdef012345",
"name": "Train board reader",
"tokenPrefix": "a1b2c3",
"permissions": ["trains:read", "fido.trainClaims:read"],
"expiresAt": "2026-12-31T23:59:59.000Z",
"revoked": false,
"createdAt": "2026-09-07T12:00:00.000Z",
"lastUsedAt": null,
"token": "<full token, shown only in this response>"
}Returns 400 if required fields or permission formats are invalid.
Lists token metadata as an array. The full token values and stored hashes are never returned.
[
{
"id": "665f1c2e9b1e8a0012a4b7c3",
"name": "fido-bot",
"tokenPrefix": "a1b2c3",
"permissions": ["fido:read", "trains:read"],
"expiresAt": null,
"revoked": false,
"createdAt": "2026-10-08T10:00:00.000Z",
"lastUsedAt": null
}
]Returns one token metadata object (same shape as an element of GET /tokens) by its MongoDB ID, or 404 with { "error": "Token not found" } if the token does not exist.
Updates any supplied token fields: name, permissions, expiresAt, or revoked.
{ "permissions": ["trains:read"], "revoked": false }Set expiresAt to null to remove its expiry. Returns 400 for invalid permissions or expiry, or 404 if the token does not exist.
Permanently deletes a token. Returns { "message": "Token deleted" } on success, or 404 if the token does not exist.