---
title: API Tokens
description: Manage scoped Bearer tokens for programmatic auth. admin grants the
  full panel API; monitor is read-only for status and metrics; node-sync manages
  node configuration without panel updates; node-admin adds panel self-update to
  node-sync. Tokens may expire and are stored as SHA-256 hashes. The plaintext
  is returned only once at creation.
full: true
_openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
      title: List every API token, enabled or not. The token value is never returned —
        only metadata.
      url: '#list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata'
    - depth: 2
      title: Mint a scoped API token. The server-generated plaintext is returned only
        once and stored as a hash.
      url: '#mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash'
    - depth: 2
      title: Permanently delete a token. Any caller using it stops authenticating
        immediately.
      url: '#permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately'
    - depth: 2
      title: Toggle a token enabled/disabled without deleting it. Disabled tokens are
        rejected by checkAPIAuth on the next request.
      url: '#toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request'
  structuredData:
    headings:
      - content: List every API token, enabled or not. The token value is never returned
          — only metadata.
        id: list-every-api-token-enabled-or-not-the-token-value-is-never-returned--only-metadata
      - content: Mint a scoped API token. The server-generated plaintext is returned
          only once and stored as a hash.
        id: mint-a-scoped-api-token-the-server-generated-plaintext-is-returned-only-once-and-stored-as-a-hash
      - content: Permanently delete a token. Any caller using it stops authenticating
          immediately.
        id: permanently-delete-a-token-any-caller-using-it-stops-authenticating-immediately
      - content: Toggle a token enabled/disabled without deleting it. Disabled tokens
          are rejected by checkAPIAuth on the next request.
        id: toggle-a-token-enableddisabled-without-deleting-it-disabled-tokens-are-rejected-by-checkapiauth-on-the-next-request
    contents: []
---

{/* This file was generated by Fumadocs. Do not edit this file directly. Any changes should be made by running the generation command again. */}

export default function Layout(props) {
  const { OpenAPIPage } = props.components ?? {};
  return (
    <>
      {props.children}
      <OpenAPIPage document="./public/openapi.json" webhooks={[]} operations={[{"path":"/panel/api/setting/apiTokens","method":"get"},{"path":"/panel/api/setting/apiTokens/create","method":"post"},{"path":"/panel/api/setting/apiTokens/delete/{id}","method":"post"},{"path":"/panel/api/setting/apiTokens/setEnabled/{id}","method":"post"}]} showTitle />
    </>
  );
}