List tokens

GET

https://api.bigcommerce.com/stores/:store_hash/v3/storefront/api-token

GET

/stores/:store_hash/v3/storefront/api-token

curl https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token \
     -H "Accept: application/json" \
     -H "X-Auth-Token: <apiKey>"

{
  "data": [
    {
      "jti": "8f14e45f-ceea-467d-9a3e-0c2f4e6b1a90",
      "type": "simple",
      "channel_ids": [
        1,
        12
      ],
      "allowed_cors_origins": [
        "https://www.yourstorefront.com"
      ],
      "scopes": [
        "Unauthenticated"
      ],
      "is_revoked": false,
      "is_expired": false,
      "name": "My storefront token",
      "principal": {
        "id": "l1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o",
        "type": "api_client"
      },
      "issued_at": 1685635176,
      "expires_at": 1885635176,
      "revoked_at": 1
    }
  ],
  "meta": {
    "pagination": {
      "total": 1,
      "count": 1,
      "per_page": 50,
      "current_page": 1,
      "total_pages": 1
    }
  }
}

Returns a paginated list of the storefront API tokens your API account has issued. The token’s JWT string is never returned; each entry includes a jti identifier that you use to revoke the token, as well as is_revoked and is_expired flags. Revoked and expired tokens are included in the list.

Required Scopes

Manage Storefront API Tokens

NOTE: This endpoint only returns tokens issued by the API account making the request, and only tokens of the family named in its path segment. Tokens issued by another API account are never returned. Customer impersonation tokens require the Storefront API Customer Impersonation Tokens scope and are never returned here.

Returns a paginated list of the storefront API tokens your API account has issued. The token's JWT string is never returned; each entry includes a `jti` identifier that you use to revoke the token, as well as `is_revoked` and `is_expired` flags. Revoked and expired tokens are included in the list. **Required Scopes** * `Manage` `Storefront API Tokens` > NOTE: This endpoint only returns tokens issued by the API account making the request, and only tokens of the family named in its path segment. Tokens issued by another API account are never returned. Customer impersonation tokens require the `Storefront API Customer Impersonation Tokens` scope and are never returned here.

Authentication

X-Auth-Tokenstring

OAuth scopes

UI Name	Permission	Parameter
Storefront API Customer Impersonation Tokens	manage	`store_storefront_api_customer_impersonation`
Storefront API Tokens	manage	`store_storefront_api`

Authentication header

Header	Argument	Description
`X-Auth-Token`	`access_token`	For more about API accounts that generate `access_token`s, see our Guide to API Accounts.

### OAuth scopes | UI Name | Permission | Parameter | |:--------|:-----------|:----------| | Storefront API Customer Impersonation Tokens | manage | `store_storefront_api_customer_impersonation` | | Storefront API Tokens | manage | `store_storefront_api` | ### Authentication header | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts). | ### Further reading For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes).

Path parameters

store_hashstringRequired

Permanent ID of the BigCommerce store.

Query parameters

pageintegerOptional>=1Defaults to 1

The page of results to return.

limitintegerOptional1-250Defaults to 50

The number of results to return per page. Values above 250 are capped at 250.

sortenumOptionalDefaults to issued_at

The field to sort the results by.

Allowed values:

directionenumOptionalDefaults to asc

The direction to sort the results by.

Allowed values:

Response

A paginated list of issued tokens.

datalist of objectsOptional

metaobjectOptional

Data about the response, including pagination.

Errors

422

Unprocessable Entity Error

Authentication

OAuth scopes

Authentication header

Further reading

Path parameters

Headers

Query parameters

Response

Errors

OAuth scopes

Authentication header

Further reading