# API tokens

Personal API tokens. These endpoints need a signed-in session: a token cannot create or list tokens.

## Endpoints

- [Revoke an API token](https://developers.lydie.co/api/api-tokens/revoke-an-api-token.md): `DELETE /v1/api-tokens/{tokenId}`
- [List your API tokens](https://developers.lydie.co/api/api-tokens/list-your-api-tokens.md): `GET /v1/workspaces/{workspaceId}/api-tokens`
- [Create an API token](https://developers.lydie.co/api/api-tokens/create-an-api-token.md): `POST /v1/workspaces/{workspaceId}/api-tokens`

## The ApiToken object

- `id` (string, required): (1–64 chars)
- `workspaceId` (string, required): (1–64 chars)
- `name` (string, required)
- `prefix` (string, required): The secret's first characters, to recognise it.
- `scopes` (string[], required)
- `createdAt` (string, required)
- `lastUsedAt` (string, required, nullable)
- `expiresAt` (string, required, nullable)

```json
{
  "id": "string",
  "workspaceId": "01JCQ3TZ0WJ8K4M2X7T9R6N1PA",
  "name": "Notes",
  "prefix": "string",
  "scopes": [
    "docs:read"
  ],
  "createdAt": "string",
  "lastUsedAt": null,
  "expiresAt": null
}
```