> This page is for Developer.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bigcommerce.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bigcommerce.com/_mcp/server.

# List private tokens

GET https://api.bigcommerce.com/stores/{store_hash}/v3/storefront/api-token-private

Returns a paginated list of the private API tokens your API account has issued. The token's JWT string is never returned; each entry includes a `jti` identifier that you use to revoke the token, as well as `is_revoked` and `is_expired` flags. Revoked and expired tokens are included in the list.

**Required Scopes**
* `Manage` `Storefront API Tokens`

> NOTE: This endpoint only returns tokens issued by the API account making the request, and only tokens of the family named in its path segment. Tokens issued by another API account are never returned. Customer impersonation tokens require the `Storefront API Customer Impersonation Tokens` scope and are never returned here.

Reference: https://docs.bigcommerce.com/developer/api-reference/rest/admin/authentication-apis/storefront-api-tokens/private-api-token/list-private-tokens

## Authentication

- `X-Auth-Token` header (required) — ### OAuth scopes | UI Name | Permission | Parameter | |:--------|:-----------|:----------| | Storefront API Customer Impersonation Tokens | manage | `store_storefront_api_customer_impersonation` | | Storefront API Tokens | manage | `store_storefront_api` | ### Authentication header | Header | Argument | Description | |:-------|:---------|:------------| | `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts). | ### Further reading For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts). For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes).

## Request

### Path parameters

- `store_hash` (string, required) — Permanent ID of the BigCommerce store.

### Query parameters

- `page` (integer, optional, default: 1) — The page of results to return.
- `limit` (integer, optional, default: 50) — The number of results to return per page. Values above 250 are capped at 250.
- `sort` (enum, optional, default: issued_at) — The field to sort the results by.
  - Allowed values: `issued_at`, `expires_at`
- `direction` (enum, optional, default: asc) — The direction to sort the results by.
  - Allowed values: `asc`, `desc`

### Headers

- `Accept` (string, required, default: application/json) — The [MIME type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types) of the response body.

## Response

### 200

A paginated list of issued tokens.

- `data` (list of IssuedToken, optional)
- `meta` (MetaPaginationObject, optional) — Data about the response, including pagination.

## Errors

### 422 Unprocessable Entity Error

Unrecognized `sort` field, `direction` value, or query parameter.

- `status` (integer, optional) — The HTTP status code.
- `title` (string, optional) — The error title describing the particular error.
- `type` (string, optional)
- `errors` (DetailedErrors, optional)

## Types

### IssuedToken

A storefront API token issued by the requesting API account. The JWT string is never returned; use the `jti` to revoke the token.

- `jti` (string, required) — Unique token identifier (the JWT `jti` claim). Use this value to revoke the token.
- `type` (enum, required) — The token family.
  - Allowed values: `simple`, `private`, `customer_impersonation`
- `channel_ids` (list of integer, required) — Channel IDs the token is valid for.
- `allowed_cors_origins` (list of string, required) — Allowed CORS origins for the token. Empty for private and customer impersonation tokens.
- `scopes` (list of enum, required) — Access scopes granted to the token. Populated for private tokens; empty for other token types.
  - Allowed values: `Unauthenticated`, `Customer`, `B2B`
- `is_revoked` (boolean, required) — Whether the token has been revoked.
- `is_expired` (boolean, required) — Whether the token has expired, evaluated against the server clock when the request is served. A token counts as expired from its `expires_at` second onward, matching the JWT `exp` semantics. Independent of `is_revoked`.
- `name` (string, optional) — Optional label set by the store owner. Only present when set. Never included in the JWT.
- `principal` (IssuedTokenPrincipal, optional) — The identity that created the token. Only present when available.
- `issued_at` (long, optional) — Unix timestamp (UTC, seconds) when the token was issued. Only present when available.
- `expires_at` (long, optional) — Unix timestamp (UTC, seconds) when the token expires. Only present when set.
- `revoked_at` (long, optional) — Unix timestamp (UTC, seconds) when the token was revoked. Only present for revoked tokens.

### MetaPaginationObject

Data about the response, including pagination.

- `pagination` (MetaPaginationObjectPagination, optional)

### DetailedErrors

### IssuedTokenPrincipal

The identity that created the token. Only present when available.

- `id` (string, optional) — ID of the principal that created the token. For an API account, this is the client ID.
- `type` (string, optional) — Type of the principal that created the token.

### MetaPaginationObjectPagination

- `total` (integer, optional) — Total number of items in the result set.
- `count` (integer, optional) — Number of items returned in the current page.
- `per_page` (integer, optional) — Number of items returned per page.
- `current_page` (integer, optional) — The current page number.
- `total_pages` (integer, optional) — Total number of pages in the result set.

## Examples

**Response**

```json
{
  "data": [
    {
      "jti": "8f14e45f-ceea-467d-9a3e-0c2f4e6b1a90",
      "type": "simple",
      "channel_ids": [
        1,
        12
      ],
      "allowed_cors_origins": [
        "https://www.yourstorefront.com"
      ],
      "scopes": [
        "Unauthenticated"
      ],
      "is_revoked": false,
      "is_expired": false,
      "name": "My storefront token",
      "principal": {
        "id": "l1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o",
        "type": "api_client"
      },
      "issued_at": 1685635176,
      "expires_at": 1885635176,
      "revoked_at": 1
    }
  ],
  "meta": {
    "pagination": {
      "total": 1,
      "count": 1,
      "per_page": 50,
      "current_page": 1,
      "total_pages": 1
    }
  }
}
```

**SDK Code**

```python
import requests

url = "https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private"

headers = {
    "Accept": "application/json",
    "X-Auth-Token": "<apiKey>"
}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private';
const options = {
  method: 'GET',
  headers: {Accept: 'application/json', 'X-Auth-Token': '<apiKey>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Accept", "application/json")
	req.Header.Add("X-Auth-Token", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Accept"] = 'application/json'
request["X-Auth-Token"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private")
  .header("Accept", "application/json")
  .header("X-Auth-Token", "<apiKey>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private', [
  'headers' => [
    'Accept' => 'application/json',
    'X-Auth-Token' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private");
var request = new RestRequest(Method.GET);
request.AddHeader("Accept", "application/json");
request.AddHeader("X-Auth-Token", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Accept": "application/json",
  "X-Auth-Token": "<apiKey>"
]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.bigcommerce.com/stores/store_hash/v3/storefront/api-token-private")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```