--- title: Tokens --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [User](https://developers.cloudflare.com/api/resources/user) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Tokens ##### [List Tokens](https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/list) GET/user/tokens ##### [Token Details](https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/get) GET/user/tokens/{token\_id} ##### [Create Token](https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/create) POST/user/tokens ##### [Update Token](https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/update) PUT/user/tokens/{token\_id} ##### [Delete Token](https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/delete) DELETE/user/tokens/{token\_id} ##### [Verify Token](https://developers.cloudflare.com/api/resources/user/subresources/tokens/methods/verify) GET/user/tokens/verify ##### ModelsExpand Collapse

TokenCreateResponse object {id, condition, creator\_email\_at\_creation, 11 more }

id: optional string Token identifier tag. maxLength32 Link to this property

condition: optional object {request\_ip }

request\_ip: optional object {in, not\_in } Client IP restrictions.

in: optional array of TokenConditionCIDRList List of IPv4/IPv6 CIDR addresses. Link to this property not\_in: optional array of TokenConditionCIDRList List of IPv4/IPv6 CIDR addresses. Link to this property

Link to this property

Link to this property creator\_email\_at\_creation: optional string The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available. maxLength90 Link to this property expires\_on: optional string The expiration time on or after which the JWT MUST NOT be accepted for processing. formatdate-time Link to this property issued\_on: optional string The time on which the token was created. formatdate-time Link to this property last\_used\_on: optional string Last time the token was used. formatdate-time Link to this property modified\_on: optional string Last time the token was modified. formatdate-time Link to this property name: optional string Token name. maxLength120 Link to this property not\_before: optional string The time before which the token MUST NOT be accepted for processing. formatdate-time Link to this property

policies: optional array of TokenPolicy { id, effect, permission\_groups, resources } List of access policies assigned to the token.

id: string Policy identifier. Link to this property

effect: "allow"or "deny" Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: array of object {id, meta, name } A set of permission groups that are specified to the policy.

id: string Identifier of the permission group. Link to this property

meta: optional object {category, deprecated, description, 5 more } Attributes associated to the permission group.

category: optional string A category used to group permission groups. Link to this property deprecated: optional string Indicates whether the permission group is deprecated. Link to this property description: optional string Additional information about the permission group. Link to this property editable: optional string Indicates whether the permission group can be edited. Link to this property eol\_at: optional string The planned end-of-life date and time, when provided. formatdate-time Link to this property label: optional string A label identifying the permission group. Link to this property scopes: optional string The scope associated with the permission group. Link to this property visibility: optional string Indicates the permission group’s availability or visibility. Link to this property

Link to this property name: optional string Name of the permission group. Link to this property

Link to this property

resources: map\[string]or map\[map\[string]] A list of resource names that the policy applies to.

One of the following: IAMResourcesTypeObjectString = map\[string] Map of simple string resource permissions Link to this property IAMResourcesTypeObjectNested = map\[map\[string]] Map of nested resource permissions Link to this property

Link to this property

Link to this property provisioner\_id: optional string The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisioner_type is present and null when the identifier is unavailable. Link to this property provisioner\_type: optional string The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens. Link to this property

status: optional "active"or "disabled"or "expired" Status of the token.

One of the following: "active" Link to this property "disabled" Link to this property "expired" Link to this property

Link to this property value: optional TokenValue The token value. maxLength80 minLength40 Link to this property

[Link to this property](<#(resource)%20user.tokens%20%3E%20(model)%20token_create_response%20%3E%20(schema)>)

TokenDeleteResponse object {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20user.tokens%20%3E%20(model)%20token_delete_response%20%3E%20(schema)>)

TokenVerifyResponse object {id, status, expires\_on, not\_before }

id: string Token identifier tag. maxLength32 Link to this property

status: "active"or "disabled"or "expired" Status of the token.

One of the following: "active" Link to this property "disabled" Link to this property "expired" Link to this property

Link to this property expires\_on: optional string The expiration time on or after which the JWT MUST NOT be accepted for processing. formatdate-time Link to this property not\_before: optional string The time before which the token MUST NOT be accepted for processing. formatdate-time Link to this property

[Link to this property](<#(resource)%20user.tokens%20%3E%20(model)%20token_verify_response%20%3E%20(schema)>) #### TokensPermission Groups ##### [List Token Permission Groups](https://developers.cloudflare.com/api/resources/user/subresources/tokens/subresources/permission_groups/methods/list) GET/user/tokens/permission\_groups ##### ModelsExpand Collapse

PermissionGroupListResponse object {id, category, is\_selectable, 2 more }

id: optional string Public ID. Link to this property

category: optional "developer\_platform"or "ai\_and\_machine\_learning"or "dns\_and\_zones"or 10 more Product category that this permission group belongs to.

One of the following: "developer\_platform" Link to this property "ai\_and\_machine\_learning" Link to this property "dns\_and\_zones" Link to this property "app\_security" Link to this property "rules\_and\_configuration" Link to this property "cloudflare\_one\_and\_zero\_trust" Link to this property "analytics\_and\_logs" Link to this property "network\_services" Link to this property "media" Link to this property "email\_and\_messaging" Link to this property "cache\_and\_performance" Link to this property "account\_and\_billing" Link to this property "other" Link to this property

Link to this property is\_selectable: optional boolean Whether the caller can select this permission group when creating a token. Link to this property name: optional string Permission Group Name Link to this property

scopes: optional array of "com.cloudflare.api.account"or "com.cloudflare.api.account.zone"or "com.cloudflare.api.user"or "com.cloudflare.edge.r2.bucket" Resources to which the Permission Group is scoped

One of the following: "com.cloudflare.api.account" Link to this property "com.cloudflare.api.account.zone" Link to this property "com.cloudflare.api.user" Link to this property "com.cloudflare.edge.r2.bucket" Link to this property

Link to this property

[Link to this property](<#(resource)%20user.tokens.permission_groups%20%3E%20(model)%20permission_group_list_response%20%3E%20(schema)>) #### TokensValue ##### [Roll Token](https://developers.cloudflare.com/api/resources/user/subresources/tokens/subresources/value/methods/update) PUT/user/tokens/{token\_id}/value