---
title: API 令牌
description: >-
  管理用于程序化认证的 Bearer 令牌（机器人、代表本节点操作的中心面板、CI）。每个令牌都有唯一的名称和一个启用标志——禁用即可在不删除的情况下吊销，删除则为永久吊销。令牌以
  SHA-256 哈希形式存储，明文仅在创建响应中返回一次——此后无法再次获取，因此请当场复制保存。在任意 /panel/api/* 请求中以
  <code>Authorization: Bearer &lt;token&gt;</code> 的形式发送令牌——该令牌是一份完全管理员凭据。
full: true
_openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
      title: >-
        List every API token, enabled or not. The token value is never returned
        — only metadata.
      url: >-
        #list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata
    - depth: 2
      title: >-
        Mint a new API token. Name must be unique and 1-64 characters; the token
        string is server-generated and returned only in this response — it is
        stored hashed and cannot be retrieved later.
      url: >-
        #mint-a-new-api-token-name-must-be-unique-and-1-64-characters-the-token-string-is-server-generated-and-returned-only-in-this-response--it-is-stored-hashed-and-cannot-be-retrieved-later
    - depth: 2
      title: >-
        Permanently delete a token. Any caller using it stops authenticating
        immediately.
      url: >-
        #permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately
    - depth: 2
      title: >-
        Toggle a token enabled/disabled without deleting it. Disabled tokens are
        rejected by checkAPIAuth on the next request.
      url: >-
        #toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request
  structuredData:
    headings:
      - content: >-
          List every API token, enabled or not. The token value is never
          returned — only metadata.
        id: >-
          list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata
      - content: >-
          Mint a new API token. Name must be unique and 1-64 characters; the
          token string is server-generated and returned only in this response —
          it is stored hashed and cannot be retrieved later.
        id: >-
          mint-a-new-api-token-name-must-be-unique-and-1-64-characters-the-token-string-is-server-generated-and-returned-only-in-this-response--it-is-stored-hashed-and-cannot-be-retrieved-later
      - content: >-
          Permanently delete a token. Any caller using it stops authenticating
          immediately.
        id: >-
          permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately
      - content: >-
          Toggle a token enabled/disabled without deleting it. Disabled tokens
          are rejected by checkAPIAuth on the next request.
        id: >-
          toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request
    contents: []
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

export default function Layout(props) {
  const { APIPage, OpenAPIPage } = props.components ?? {};
  // "APIPage" is the old name from v10, this allows both for backward compatibility
  const Comp = OpenAPIPage ?? APIPage;
  return (
    <>
      {props.children}
      <Comp document="./public/openapi.json" webhooks={[]} operations={[{"path":"/panel/api/setting/apiTokens","method":"get"},{"path":"/panel/api/setting/apiTokens/create","method":"post"},{"path":"/panel/api/setting/apiTokens/delete/{id}","method":"post"},{"path":"/panel/api/setting/apiTokens/setEnabled/{id}","method":"post"}]} showTitle />
    </>
  );
}