# List an account’s tokens

**GET** `/api/embed/v1/accounts/{accountId}/tokens`

Lists an account’s API tokens that still work, newest first. Never the token itself.

Needs a partner key: `Authorization: Bearer gre_…`, from [Platform › Partner keys](https://docs.gorunner.io/embed/platform-screens#partner-keys). Call it from your server only.

Embed · Self-hosted with an Embed license

## Parameters

### Path

- `accountId` · Required · string: Your ID for the customer’s account: 1 to 255 bytes of UTF-8, case-sensitive. URL-encode it: it may contain `/`.

### Query

- `workspaceId` · Optional · string: Only this workspace’s tokens, by your ID.
- `cursor` · Optional · string: The `pagination.nextCursor` of the page before. Left out: the first page.
- `limit` · Optional · integer: Rows a page, 1 to 100. The default is 50.

## Read a row

`access` is the widest it reaches: `read`; `run`, which also starts, cancels and re-runs runs; or `build`, which also makes and changes workflows and connections. A token made with its own `scopes` reads `custom`. `surfaces`: `api`, `mcp` (AI apps), or both. `expiring`: it stops within 7 days.

## Responses

- 200 OK

  A page of tokens: the ones its editors made and the ones your server made.

- 400 `VALIDATION_ERROR`

  A parameter isn’t valid. `details.field` names it.

- 404 `NOT_FOUND`

  No such account, or no such workspace in it.

- 500 `INTERNAL_ERROR`

  Something failed on the installation’s side. Try again.

Any call can also answer: [`401 UNAUTHORIZED`](https://docs.gorunner.io/errors#UNAUTHORIZED) · [`403 EMBED_NOT_LICENSED`](https://docs.gorunner.io/errors#EMBED_NOT_LICENSED) · [`403 IP_NOT_ALLOWED`](https://docs.gorunner.io/errors#IP_NOT_ALLOWED) · [`429 RATE_LIMITED`](https://docs.gorunner.io/errors#RATE_LIMITED) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY). See [Errors](https://docs.gorunner.io/embed/api#errors).

Request

**curl**

```bash
GORUNNER="https://automations.example.com"
GORUNNER_EMBED_KEY="YOUR_PARTNER_KEY"  # gre_…
ACCOUNT_ID="acct-bakery"

URL="$GORUNNER/api/embed/v1/accounts/$ACCOUNT_ID/"
URL="${URL}tokens"
curl "$URL" \
  -H "Authorization: Bearer $GORUNNER_EMBED_KEY"
```

**JavaScript**

```js
const GORUNNER = "https://automations.example.com";
const KEY = process.env.GORUNNER_EMBED_KEY; // gre_…
const ACCOUNT_ID = encodeURIComponent("acct-bakery");

const res = await fetch(
  `${GORUNNER}/api/embed/v1/accounts/` +
    `${ACCOUNT_ID}/tokens`,
  {
    headers: { Authorization: `Bearer ${KEY}` },
  },
);
const { data } = await res.json();
```

**Python**

```python
import os, requests
from urllib.parse import quote

GORUNNER = "https://automations.example.com"
KEY = os.environ["GORUNNER_EMBED_KEY"]  # gre_…
ACCOUNT_ID = quote("acct-bakery", safe="")

res = requests.get(
    f"{GORUNNER}/api/embed/v1/accounts/"
    f"{ACCOUNT_ID}/tokens",
    headers={"Authorization": f"Bearer {KEY}"},
)
data = res.json()["data"]
```

Response · 200 OK

```json
{
  "data": [
    {
      "id": "6e9a1c3f-8b2d-4a57-9e0c-3f7b5d1a8c42",
      "name": "Nightly sync",
      "prefix": "grt_3f9a1c2b",
      "access": "run",
      "scopes": [
        "workflow:read",
        "connection:read",
        "run:read",
        "workflow:run",
        "run:manage"
      ],
      "surfaces": [
        "api"
      ],
      "workspaceId": null,
      "createdBy": {
        "kind": "partner"
      },
      "createdAt": "2026-10-20T08:00:00Z",
      "expiresAt": "2027-01-18T08:00:00Z",
      "lastUsedAt": "2026-10-25T09:00:00Z",
      "expiring": false,
      "turnedOff": []
    }
  ],
  "pagination": {
    "limit": 50,
    "nextCursor": null
  }
}
```

**Every field**

It takes no body.

### Response · 200 OK

- `data` · array of objects
  - `id` · UUID
  - `name` · string
  - `prefix` · string: The token’s first characters (`grt_` and 8 more), to tell tokens apart.
  - `access` · string: The widest level its scopes reach: read; run (also start, cancel and re-run runs); build (also create and change workflows and connections). `custom`: it was made with `scopes` that are not exactly one of those levels. One of `read`, `run`, `build`, `custom`.
  - `scopes` · array of strings
  - `surfaces` · array of strings: Where it works: `api` (the App API) and `mcp` (AI apps, over MCP). One of `api`, `mcp`.
  - `workspaceId` · string or null: The partner’s id of its workspace; null for the account’s default workspace.
  - `createdBy` · object
    - `kind` · string: One of `person`, `partner`.
    - `id` · string: The partner’s user id of the editor who made it (kind person).
    - `name` · string
  - `createdAt` · time
  - `expiresAt` · time
  - `lastUsedAt` · time or null
  - `expiring` · boolean: It stops within seven days.
  - `turnedOff` · array of strings: Switches turned off for this token alone.
- `pagination` · object
  - `limit` · integer
  - `nextCursor` · string or null: The `cursor` of the next page; null on the last page. A page that comes back full can carry a cursor even when nothing follows: the next page is then empty, with null here. Keep going until it is null.

Related: [Make a token](https://docs.gorunner.io/embed/api/tokens/create-token) · [Tokens and AI apps](https://docs.gorunner.io/embed/tokens-and-ai-apps)

Source: https://docs.gorunner.io/embed/api/tokens/list-tokens