--- title: Tokens --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Accounts](https://developers.cloudflare.com/api/typescript/resources/accounts) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Tokens ##### [List Tokens](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/methods/list) client.accounts.tokens.list(TokenListParams {account\_id, direction, include\_expired, 2 more } params, RequestOptionsoptions?): V4PagePaginationArray< [Token]() {id, condition, creator\_email\_at\_creation, 10 more } > GET/accounts/{account\_id}/tokens ##### [Token Details](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/methods/get) client.accounts.tokens.get(stringtokenID, TokenGetParams {account\_id } params, RequestOptionsoptions?): [Token]() {id, condition, creator\_email\_at\_creation, 10 more } GET/accounts/{account\_id}/tokens/{token\_id} ##### [Create Token](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/methods/create) client.accounts.tokens.create(TokenCreateParams {account\_id, name, policies, 3 more } params, RequestOptionsoptions?): [TokenCreateResponse]() {id, condition, creator\_email\_at\_creation, 11 more } POST/accounts/{account\_id}/tokens ##### [Update Token](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/methods/update) client.accounts.tokens.update(stringtokenID, TokenUpdateParams {account\_id, name, policies, 4 more } params, RequestOptionsoptions?): [Token]() {id, condition, creator\_email\_at\_creation, 10 more } PUT/accounts/{account\_id}/tokens/{token\_id} ##### [Delete Token](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/methods/delete) client.accounts.tokens.delete(stringtokenID, TokenDeleteParams {account\_id } params, RequestOptionsoptions?): [TokenDeleteResponse]() {id } | null DELETE/accounts/{account\_id}/tokens/{token\_id} ##### [Verify Token](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/methods/verify) client.accounts.tokens.verify(TokenVerifyParams {account\_id } params, RequestOptionsoptions?): [TokenVerifyResponse]() {id, status, expires\_on, not\_before } GET/accounts/{account\_id}/tokens/verify ##### ModelsExpand Collapse

TokenCreateResponse {id, condition, creator\_email\_at\_creation, 11 more }

id?: string Token identifier tag. maxLength32 Link to this property

condition?: Condition {request\_ip }

request\_ip?: RequestIP {in, not\_in } Client IP restrictions.

in?: Array<TokenConditionCIDRList> List of IPv4/IPv6 CIDR addresses. Link to this property not\_in?: Array<TokenConditionCIDRList> List of IPv4/IPv6 CIDR addresses. Link to this property

Link to this property

Link to this property creator\_email\_at\_creation?: string The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available. maxLength90 Link to this property expires\_on?: string The expiration time on or after which the JWT MUST NOT be accepted for processing. formatdate-time Link to this property issued\_on?: string The time on which the token was created. formatdate-time Link to this property last\_used\_on?: string Last time the token was used. formatdate-time Link to this property modified\_on?: string Last time the token was modified. formatdate-time Link to this property name?: string Token name. maxLength120 Link to this property not\_before?: string The time before which the token MUST NOT be accepted for processing. formatdate-time Link to this property

policies?: Array<TokenPolicy {id, effect, permission\_groups, resources } > List of access policies assigned to the token.

id: string Policy identifier. Link to this property

effect: "allow"| "deny" Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: Array<PermissionGroup> A set of permission groups that are specified to the policy.

id: string Identifier of the permission group. Link to this property

meta?: Meta {category, deprecated, description, 5 more } Attributes associated to the permission group.

category?: string A category used to group permission groups. Link to this property deprecated?: string Indicates whether the permission group is deprecated. Link to this property description?: string Additional information about the permission group. Link to this property editable?: string Indicates whether the permission group can be edited. Link to this property eol\_at?: string The planned end-of-life date and time, when provided. formatdate-time Link to this property label?: string A label identifying the permission group. Link to this property scopes?: string The scope associated with the permission group. Link to this property visibility?: string Indicates the permission group’s availability or visibility. Link to this property

Link to this property name?: string Name of the permission group. Link to this property

Link to this property

resources: Record<string, string>| Record<string, Record<string, string>> A list of resource names that the policy applies to.

One of the following: Record<string, string> Link to this property Record<string, Record<string, string>> Link to this property

Link to this property

Link to this property provisioner\_id?: string| null The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisioner_type is present and null when the identifier is unavailable. Link to this property provisioner\_type?: string The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens. Link to this property

status?: "active"| "disabled"| "expired" Status of the token.

One of the following: "active" Link to this property "disabled" Link to this property "expired" Link to this property

Link to this property value?: TokenValue The token value. maxLength80 minLength40 Link to this property

[Link to this property](<#(resource)%20accounts.tokens%20%3E%20(model)%20token_create_response%20%3E%20(schema)>)

TokenDeleteResponse {id }

id: string Identifier maxLength32 minLength32 Link to this property

[Link to this property](<#(resource)%20accounts.tokens%20%3E%20(model)%20token_delete_response%20%3E%20(schema)>)

TokenVerifyResponse {id, status, expires\_on, not\_before }

id: string Token identifier tag. maxLength32 Link to this property

status: "active"| "disabled"| "expired" Status of the token.

One of the following: "active" Link to this property "disabled" Link to this property "expired" Link to this property

Link to this property expires\_on?: string The expiration time on or after which the JWT MUST NOT be accepted for processing. formatdate-time Link to this property not\_before?: string The time before which the token MUST NOT be accepted for processing. formatdate-time Link to this property

[Link to this property](<#(resource)%20accounts.tokens%20%3E%20(model)%20token_verify_response%20%3E%20(schema)>) #### TokensPermission Groups ##### [List Permission Groups](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/subresources/permission_groups/methods/list) client.accounts.tokens.permissionGroups.list(PermissionGroupListParams {account\_id, name, scope } params, RequestOptionsoptions?): SinglePage< [PermissionGroupListResponse]() {id, category, is\_selectable, 2 more } > GET/accounts/{account\_id}/tokens/permission\_groups ##### [List Permission Groups](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/subresources/permission_groups/methods/get) client.accounts.tokens.permissionGroups.get(PermissionGroupGetParams {account\_id, name, scope } params, RequestOptionsoptions?): [PermissionGroupGetResponse]() {id, category, is\_selectable, 2 more } GET/accounts/{account\_id}/tokens/permission\_groups ##### ModelsExpand Collapse

PermissionGroupListResponse {id, category, is\_selectable, 2 more }

id?: string Public ID. Link to this property

category?: "developer\_platform"| "ai\_and\_machine\_learning"| "dns\_and\_zones"| 10 more Product category that this permission group belongs to.

One of the following: "developer\_platform" Link to this property "ai\_and\_machine\_learning" Link to this property "dns\_and\_zones" Link to this property "app\_security" Link to this property "rules\_and\_configuration" Link to this property "cloudflare\_one\_and\_zero\_trust" Link to this property "analytics\_and\_logs" Link to this property "network\_services" Link to this property "media" Link to this property "email\_and\_messaging" Link to this property "cache\_and\_performance" Link to this property "account\_and\_billing" Link to this property "other" Link to this property

Link to this property is\_selectable?: boolean Whether the caller can select this permission group when creating a token. Link to this property name?: string Permission Group Name Link to this property

scopes?: Array<"com.cloudflare.api.account"| "com.cloudflare.api.account.zone"| "com.cloudflare.api.user"| "com.cloudflare.edge.r2.bucket"> Resources to which the Permission Group is scoped

One of the following: "com.cloudflare.api.account" Link to this property "com.cloudflare.api.account.zone" Link to this property "com.cloudflare.api.user" Link to this property "com.cloudflare.edge.r2.bucket" Link to this property

Link to this property

[Link to this property](<#(resource)%20accounts.tokens.permission_groups%20%3E%20(model)%20permission_group_list_response%20%3E%20(schema)>)

PermissionGroupGetResponse = Array<PermissionGroupGetResponseItem>

id?: string Public ID. Link to this property

category?: "developer\_platform"| "ai\_and\_machine\_learning"| "dns\_and\_zones"| 10 more Product category that this permission group belongs to.

scopes?: Array<"com.cloudflare.api.account"| "com.cloudflare.api.account.zone"| "com.cloudflare.api.user"| "com.cloudflare.edge.r2.bucket"> Resources to which the Permission Group is scoped

Link to this property

[Link to this property](<#(resource)%20accounts.tokens.permission_groups%20%3E%20(model)%20permission_group_get_response%20%3E%20(schema)>) #### TokensValue ##### [Roll Token](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/tokens/subresources/value/methods/update) client.accounts.tokens.value.update(stringtokenID, ValueUpdateParams {account\_id } params, RequestOptionsoptions?): [TokenValue]() PUT/accounts/{account\_id}/tokens/{token\_id}/value