Tokens

Long-lived credentials for publishing from a script, a CI job or an agent. A token is shown once when it is created and is recoverable nowhere afterwards, so what is listed here is a name and a prefix rather than a secret.

Lists the account's access tokens, including revoked ones.

GET

https://dropto.run

/api/tokens

d2r_session (cookie)

Lists the account's access tokens, including revoked ones. › Responses

Response of `GET /api/tokens`.

ListTokensResponse

AccountTokenSummary[] · required

What colleagues hold on the same account, and only what an owner is entitled to know about them. Empty for a member, and empty for an owner whose colleagues have none.

A separate list rather than the same rows with fields blanked out, because a row that is sometimes missing its prefix is a row whose type is a lie — and the screen showing it has to branch on something either way.

TokenSummary[] · required

The caller's own tokens on this account, newest first, including revoked ones.

Issues an access token and returns its plaintext, which is not recoverable later.

POST

https://dropto.run

/api/tokens

d2r_session (cookie)

Issues an access token and returns its plaintext, which is not recoverable later. › Request Body

Request body of `POST /api/tokens`.

CreateTokenRequest

expiresInDays

null | integer | string · int32 · pattern: ^-?(?:0|[1-9]\d*)$ · required

How long it should last, or null for a token that never expires on its own.

name

string · minLength: 1 · maxLength: 64 · required

What to call the token, so its owner can tell it from their others.

Issues an access token and returns its plaintext, which is not recoverable later. › Responses

Created

Response of `POST /api/tokens`.

CreateTokenResponse

createdAt

string · date-time · required

When it was issued.

expiresAt

null | string · date-time · required

When it stops working on its own, or null.

id

string · required

ULID of the new token.

name

string · required

The name it was given.

prefix

string · required

Its first characters, which is what every later listing shows.

token

string · required

The plaintext. Returned exactly once and recoverable nowhere.

Revokes an access token. Idempotent: revoking a revoked token succeeds.

DELETE

https://dropto.run

/api/tokens/{tokenId}

d2r_session (cookie)

Revokes an access token. Idempotent: revoking a revoked token succeeds. › path Parameters

tokenId

string · required

Revokes an access token. Idempotent: revoking a revoked token succeeds. › Responses

Response of `DELETE /api/tokens/{tokenId}`.

RevokeTokenResponse

id

string · required

ULID of the token that no longer works.

revokedAt

string · date-time · required

When it stopped working, which is unchanged if it already had.

Support Sites