GoRunner docs
Search or askSearch⌘K

List an account’s tokens

Since v2026.10.4

GET/api/embed/v1/accounts/{accountId}/tokens

Lists an account’s API tokens that still work, newest first. Never the token itself.

Needs a partner key: Authorization: Bearer gre_…, from Platform › Partner keys. Call it from your server only.

Embed · Self-hosted with an Embed license

Parameters

Path

accountIdRequired · string

Your ID for the customer’s account: 1 to 255 bytes of UTF-8, case-sensitive. URL-encode it: it may contain /.

Query

workspaceIdOptional · string

Only this workspace’s tokens, by your ID.

cursorOptional · string

The pagination.nextCursor of the page before. Left out: the first page.

limitOptional · integer

Rows a page, 1 to 100. The default is 50.

Read a row

access is the widest it reaches: read; run, which also starts, cancels and re-runs runs; or build, which also makes and changes workflows and connections. A token made with its own scopes reads custom. surfaces: api, mcp (AI apps), or both. expiring: it stops within 7 days.

Responses

  • 200OK

    A page of tokens: the ones its editors made and the ones your server made.

  • A parameter isn’t valid. details.field names it.

  • No such account, or no such workspace in it.

  • Something failed on the installation’s side. Try again.

Any call can also answer: 401 UNAUTHORIZED · 403 EMBED_NOT_LICENSED · 403 IP_NOT_ALLOWED · 429 RATE_LIMITED · 503 BUSY. See Errors.

Request

GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…
ACCOUNT_ID="acct-bakery"

URL="$GORUNNER/api/embed/v1/accounts/$ACCOUNT_ID/"
URL="${URL}tokens"
curl "$URL" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY"

Response · 200 OK

json
{
  "data": [
    {
      "id": "6e9a1c3f-8b2d-4a57-9e0c-3f7b5d1a8c42",
      "name": "Nightly sync",
      "prefix": "grt_3f9a1c2b",
      "access": "run",
      "scopes": [
        "workflow:read",
        "connection:read",
        "run:read",
        "workflow:run",
        "run:manage"
      ],
      "surfaces": [
        "api"
      ],
      "workspaceId": null,
      "createdBy": {
        "kind": "partner"
      },
      "createdAt": "2026-10-20T08:00:00Z",
      "expiresAt": "2027-01-18T08:00:00Z",
      "lastUsedAt": "2026-10-25T09:00:00Z",
      "expiring": false,
      "turnedOff": []
    }
  ],
  "pagination": {
    "limit": 50,
    "nextCursor": null
  }
}
Every field

It takes no body.

Response · 200 OK

dataarray of objects
idUUID
namestring
prefixstring

The token’s first characters (grt_ and 8 more), to tell tokens apart.

accessstring

The widest level its scopes reach: read; run (also start, cancel and re-run runs); build (also create and change workflows and connections). custom: it was made with scopes that are not exactly one of those levels.

One of read, run, build, custom.

scopesarray of strings
surfacesarray of strings

Where it works: api (the App API) and mcp (AI apps, over MCP).

One of api, mcp.

workspaceIdstring or null

The partner’s id of its workspace; null for the account’s default workspace.

createdByobject
kindstring

One of person, partner.

idstring

The partner’s user id of the editor who made it (kind person).

namestring
createdAttime
expiresAttime
lastUsedAttime or null
expiringboolean

It stops within seven days.

turnedOffarray of strings

Switches turned off for this token alone.

paginationobject
limitinteger
nextCursorstring or null

The cursor of the next page; null on the last page. A page that comes back full can carry a cursor even when nothing follows: the next page is then empty, with null here. Keep going until it is null.