> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# List customer impersonation tokens

GET https://api.bigcommerce.com/stores/{store_hash}/v3/storefront/api-token-customer-impersonation

Returns a paginated list of the customer impersonation tokens your API account has issued. The token's JWT string is never returned; each entry includes a `jti` identifier that you use to revoke the token, as well as `is_revoked` and `is_expired` flags. Revoked and expired tokens are included in the list.

**Required Scopes**
* `Manage` `Storefront API Customer Impersonation Tokens`

> NOTE: This endpoint only returns customer impersonation tokens issued by the API account making the request. Tokens issued by another API account are never returned. Storefront and private tokens require the `Storefront API Tokens` scope and are never returned here.

Reference: https://docs.bigcommerce.com/developer/api-reference/rest/admin/authentication-apis/storefront-api-tokens/customer-impersonation-token/list-customer-impersonation-tokens

## Authentication

- `X-Auth-Token` header (required) — ### OAuth scopes | UI Name | Permission | Parameter | |:--------|:-----------|:----------| | Storefront API Customer Impersonation Tokens | manage | `store_storefront_api_customer_impersonation` | | Storefront API Tokens | manage | `store_storefront_api` | ### Authentication header | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts). | ### Further reading For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes).

## Request

### Path parameters

- `store_hash` (string, required) — Permanent ID of the BigCommerce store.

### Query parameters

- `page` (integer, optional, default: 1) — The page of results to return.
- `limit` (integer, optional, default: 50) — The number of results to return per page. Values above 250 are capped at 250.
- `sort` (enum, optional, default: issued_at) — The field to sort the results by.
  - Allowed values: `issued_at`, `expires_at`
- `direction` (enum, optional, default: asc) — The direction to sort the results by.
  - Allowed values: `asc`, `desc`

### Headers

- `Accept` (string, required, default: application/json) — The [MIME type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types) of the response body.

## Response

### 200

A paginated list of issued tokens.

- `data` (list of IssuedToken, optional)
- `meta` (MetaPaginationObject, optional) — Data about the response, including pagination.

## Errors

### 422 Unprocessable Entity Error

Unrecognized `sort` field, `direction` value, or query parameter.

- `status` (integer, optional) — The HTTP status code.
- `title` (string, optional) — The error title describing the particular error.
- `type` (string, optional)
- `errors` (DetailedErrors, optional)

## Types

### IssuedToken

A storefront API token issued by the requesting API account. The JWT string is never returned; use the `jti` to revoke the token.

- `jti` (string, required) — Unique token identifier (the JWT `jti` claim). Use this value to revoke the token.
- `type` (enum, required) — The token family.
  - Allowed values: `simple`, `private`, `customer_impersonation`
- `channel_ids` (list of integer, required) — Channel IDs the token is valid for.
- `allowed_cors_origins` (list of string, required) — Allowed CORS origins for the token. Empty for private and customer impersonation tokens.
- `scopes` (list of enum, required) — Access scopes granted to the token. Populated for private tokens; empty for other token types.
  - Allowed values: `Unauthenticated`, `Customer`, `B2B`
- `is_revoked` (boolean, required) — Whether the token has been revoked.
- `is_expired` (boolean, required) — Whether the token has expired, evaluated against the server clock when the request is served. A token counts as expired from its `expires_at` second onward, matching the JWT `exp` semantics. Independent of `is_revoked`.
- `name` (string, optional) — Optional label set by the store owner. Only present when set. Never included in the JWT.
- `principal` (IssuedTokenPrincipal, optional) — The identity that created the token. Only present when available.
- `issued_at` (long, optional) — Unix timestamp (UTC, seconds) when the token was issued. Only present when available.
- `expires_at` (long, optional) — Unix timestamp (UTC, seconds) when the token expires. Only present when set.
- `revoked_at` (long, optional) — Unix timestamp (UTC, seconds) when the token was revoked. Only present for revoked tokens.

### MetaPaginationObject

Data about the response, including pagination.

- `pagination` (MetaPaginationObjectPagination, optional)

### DetailedErrors

### IssuedTokenPrincipal

The identity that created the token. Only present when available.

- `id` (string, optional) — ID of the principal that created the token. For an API account, this is the client ID.
- `type` (string, optional) — Type of the principal that created the token.

### MetaPaginationObjectPagination

- `total` (integer, optional) — Total number of items in the result set.
- `count` (integer, optional) — Number of items returned in the current page.
- `per_page` (integer, optional) — Number of items returned per page.
- `current_page` (integer, optional) — The current page number.
- `total_pages` (integer, optional) — Total number of pages in the result set.

## Examples

**Response**

```json
{
  "data": [
    {
      "jti": "8f14e45f-ceea-467d-9a3e-0c2f4e6b1a90",
      "type": "simple",
      "channel_ids": [
        1,
        12
      ],
      "allowed_cors_origins": [
        "https://www.yourstorefront.com"
      ],
      "scopes": [
        "Unauthenticated"
      ],
      "is_revoked": false,
      "is_expired": false,
      "name": "My storefront token",
      "principal": {
        "id": "l1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o",
        "type": "api_client"
      },
      "issued_at": 1685635176,
      "expires_at": 1885635176,
      "revoked_at": 1
    }
  ],
  "meta": {
    "pagination": {
      "total": 1,
      "count": 1,
      "per_page": 50,
      "current_page": 1,
      "total_pages": 1
    }
  }
}
```

**SDK Code**

```python
import requests

url = "https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation"

headers = {
    "Accept": "application/json",
    "X-Auth-Token": "<apiKey>"
}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation';
const options = {
  method: 'GET',
  headers: {Accept: 'application/json', 'X-Auth-Token': '<apiKey>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Accept", "application/json")
	req.Header.Add("X-Auth-Token", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Accept"] = 'application/json'
request["X-Auth-Token"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation")
  .header("Accept", "application/json")
  .header("X-Auth-Token", "<apiKey>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation', [
  'headers' => [
    'Accept' => 'application/json',
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation");
var request = new RestRequest(Method.GET);
request.AddHeader("Accept", "application/json");
request.AddHeader("X-Auth-Token", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Accept": "application/json",
  "X-Auth-Token": "<apiKey>"
]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-customer-impersonation")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```