API keys

Tokens authenticate API requests. Sign-ins create 30-day session tokens; the endpoints here manage long-lived key tokens for scripts and integrations.

Create a key

POST /v1/tokens

curl -s https://api.tpp.io/v1/tokens \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name": "ci", "days": 0}'

{ "id": "...", "token": "...", "expires_at": null }

days defaults to 30; 0 makes the key non-expiring. The token value is returned once - store it, only a hash is kept server-side.

List your tokens

GET /v1/tokens

{
  "tokens": [
    { "id": "...", "name": "ci", "kind": "key", "created_at": "2026-07-20T10:00:00Z", "last_used": "2026-07-29T08:12:44Z" },
    { "id": "...", "name": "sign-in", "kind": "session", "created_at": "2026-07-28T18:03:11Z", "last_used": null }
  ]
}

Revoke a token

DELETE /v1/tokens/{id}

Returns {"revoked": "<id>"}. Revoking works on sessions too - use it to sign out other devices. POST /v1/auth/logout is the shortcut for revoking the token you’re currently using.