---
title: API Tokens
description: 'Manage Bearer tokens used for programmatic auth (bots, central
  panels acting on this node, CI). Each token has a unique name and an enabled
  flag — disable to revoke without deleting, delete to revoke permanently.
  Tokens are stored as SHA-256 hashes and the plaintext is returned only once,
  in the create response — it cannot be retrieved afterwards, so copy it then.
  Send one as <code>Authorization: Bearer &lt;token&gt;</code> on any
  /panel/api/* request — the token is a full-admin credential.'
full: true
_openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
      title: List every API token, enabled or not. The token value is never returned —
        only metadata.
      url: '#list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata'
    - depth: 2
      title: Mint a scoped API token. The server-generated plaintext is returned only
        once and stored as a hash.
      url: '#mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash'
    - depth: 2
      title: Permanently delete a token. Any caller using it stops authenticating
        immediately.
      url: '#permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately'
    - depth: 2
      title: Toggle a token enabled/disabled without deleting it. Disabled tokens are
        rejected by checkAPIAuth on the next request.
      url: '#toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request'
  structuredData:
    headings:
      - content: List every API token, enabled or not. The token value is never returned
          — only metadata.
        id: list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata
      - content: Mint a scoped API token. The server-generated plaintext is returned
          only once and stored as a hash.
        id: mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash
      - content: Permanently delete a token. Any caller using it stops authenticating
          immediately.
        id: permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately
      - content: Toggle a token enabled/disabled without deleting it. Disabled tokens
          are rejected by checkAPIAuth on the next request.
        id: toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request
    contents: []
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

export default function Layout(props) {
  const { APIPage, OpenAPIPage } = props.components ?? {};
  // "APIPage" is the old name from v10, this allows both for backward compatibility
  const Comp = OpenAPIPage ?? APIPage;
  return (
    <>
      {props.children}
      <Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/panel/api/setting/apiTokens","method":"get"},{"path":"/panel/api/setting/apiTokens/create","method":"post"},{"path":"/panel/api/setting/apiTokens/delete/{id}","method":"post"},{"path":"/panel/api/setting/apiTokens/setEnabled/{id}","method":"post"}]} showTitle />
    </>
  );
}