List an account’s tokens
This page needs your own installation with an Embed license.
GET/
Lists an account’s API tokens that still work, newest first. Never the token itself.
Needs a partner key: Authorization: Bearer gre_…, from Platform › Partner keys. Call it from your server only.
Parameters
Path
accountIdRequired · stringYour ID for the customer’s account: 1 to 255 bytes of UTF-8, case-sensitive. URL-encode it: it may contain
/.
Query
workspaceIdOptional · stringOnly this workspace’s tokens, by your ID.
cursorOptional · stringThe
pagination.nextCursorof the page before. Left out: the first page.limitOptional · integerRows a page, 1 to 100. The default is 50.
Read a row
access is the widest it reaches: read; run, which also starts, cancels and re-runs runs; or build, which also makes and changes workflows and connections. A token made with its own scopes reads custom. surfaces: api, mcp (AI apps), or both. expiring: it stops within 7 days.
Responses
- 200OK
A page of tokens: the ones its editors made and the ones your server made.
A parameter isn’t valid.
details.fieldnames it.- 404
NOT_FOUNDNo such account, or no such workspace in it.
Something failed on the installation’s side. Try again.
Any call can also answer: 401 UNAUTHORIZED · 403 EMBED_NOT_LICENSED · 403 IP_NOT_ALLOWED · 429 RATE_LIMITED · 503 BUSY. See Errors.
Request
GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY" # gre_…
ACCOUNT_ID="acct-bakery"
URL="$GORUNNER/api/embed/v1/accounts/$ACCOUNT_ID/"
URL="${URL}tokens"
curl "$URL" \
-H "Authorization: Bearer $GORUNNER_EMBED_KEY"const GORUNNER = "https://automations.example.com";
const KEY = process.env.GORUNNER_EMBED_KEY; // gre_…
const ACCOUNT_ID = encodeURIComponent("acct-bakery");
const res = await fetch(
`${GORUNNER}/api/embed/v1/accounts/` +
`${ACCOUNT_ID}/tokens`,
{
headers: { Authorization: `Bearer ${KEY}` },
},
);
const { data } = await res.json();import os, requests
from urllib.parse import quote
GORUNNER = "https://automations.example.com"
KEY = os.environ["GORUNNER_EMBED_KEY"] # gre_…
ACCOUNT_ID = quote("acct-bakery", safe="")
res = requests.get(
f"{GORUNNER}/api/embed/v1/accounts/"
f"{ACCOUNT_ID}/tokens",
headers={"Authorization": f"Bearer {KEY}"},
)
data = res.json()["data"]Response · 200 OK
{
"data": [
{
"id": "6e9a1c3f-8b2d-4a57-9e0c-3f7b5d1a8c42",
"name": "Nightly sync",
"prefix": "grt_3f9a1c2b",
"access": "run",
"scopes": [
"workflow:read",
"connection:read",
"run:read",
"workflow:run",
"run:manage"
],
"surfaces": [
"api"
],
"workspaceId": null,
"createdBy": {
"kind": "partner"
},
"createdAt": "2026-10-20T08:00:00Z",
"expiresAt": "2027-01-18T08:00:00Z",
"lastUsedAt": "2026-10-25T09:00:00Z",
"expiring": false,
"turnedOff": []
}
],
"pagination": {
"limit": 50,
"nextCursor": null
}
}Every field
It takes no body.
Response · 200 OK
dataarray of objectsidUUIDnamestringprefixstringThe token’s first characters (
grt_and 8 more), to tell tokens apart.accessstringThe widest level its scopes reach: read; run (also start, cancel and re-run runs); build (also create and change workflows and connections).
custom: it was made withscopesthat are not exactly one of those levels.One of
read,run,build,custom.scopesarray of stringssurfacesarray of stringsWhere it works:
api(the App API) andmcp(AI apps, over MCP).One of
api,mcp.workspaceIdstring or nullThe partner’s id of its workspace; null for the account’s default workspace.
createdByobjectkindstringOne of
person,partner.idstringThe partner’s user id of the editor who made it (kind person).
namestringcreatedAttimeexpiresAttimelastUsedAttime or nullexpiringbooleanIt stops within seven days.
turnedOffarray of stringsSwitches turned off for this token alone.
paginationobjectlimitintegernextCursorstring or nullThe
cursorof the next page; null on the last page. A page that comes back full can carry a cursor even when nothing follows: the next page is then empty, with null here. Keep going until it is null.