Api tokens

Delete Customer Token

Permanently revokes a customer-scoped API token. Users can only delete tokens within their customer scope.

DELETE /api/customer/tokens/:id

Example (cURL)

curl -X DELETE "$BASE_URL/api/customer/tokens/2" \
  -H "Cookie: $SESSION_COOKIE"

{ "success": true }

403 Forbidden when the token is outside your customer scope, or when the token is org-scoped (no customerId)
404 Token not found when the token doesn't exist or belongs to another org

Create Organization Token

Creates a new API token. The full token is returned only once — store it securely. Requires admin role.

Delete Organization Token

Permanently revokes an API token. Requires admin role.