---
title: User tokens
summary: An API Token is used to identify who is making the API call. Users can create multiple tokens to suit their needs.
url: https://www.fastly.com/documentation/reference/api/auth-tokens/user
---

An API Token is used to identify who is making the API call. Users can create multiple tokens to suit their needs.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `name` | string | Name of the token. |
| `scope` | string | Space-delimited list of authorization scope. |
| `services` | array | List of alphanumeric strings identifying services (optional). If no services are specified, the token will have access to all services on the account. (Read-only) |
| `access_token` | string | The alphanumeric string for accessing the API (only available on token creation). |
| `created_at` | string | Time-stamp (UTC) of when the token was created. (Read-only) |
| `deleted_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `expires_at` | string | Time-stamp (UTC) of when the token will expire (optional). |
| `id` | string | Alphanumeric string identifying a token. (Read-only) |
| `ip` | string | IP Address of the client that last used the token. |
| `last_used_at` | string | Time-stamp (UTC) of when the token was last used. (Read-only) |
| `updated_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `user_agent` | string | User-Agent header of the client that last used the token. |
| `user_id` | string | Alphanumeric string identifying the user. (Read-only) |

## API endpoints

### List tokens for the authenticated user

**GET** `/tokens`

List all tokens belonging to the authenticated user.

### Create a token

**POST** `/tokens`

Create an API token. If two-factor authentication is enabled for your account, review <a href="https://www.fastly.com/documentation/reference/api/auth-tokens/user/">the instructions</a> for including a one-time password in the request.

### Revoke multiple tokens

**DELETE** `/tokens`

Revoke Tokens in bulk format. Users may only revoke their own tokens. Superusers may revoke tokens of others.

### List tokens for a customer

**GET** `/customer/{customer_id}/tokens`

List all tokens belonging to a specific customer.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `customer_id` | string | path | Yes | Alphanumeric string identifying the customer. |

### Get the current token

**GET** `/tokens/self`

Get a single token based on the access_token used in the request.

### Revoke the current token

**DELETE** `/tokens/self`

Revoke a token that is used to authenticate the request.

### Get a token

**GET** `/tokens/{token_id}`

Get a single token by its id.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `token_id` | string | path | Yes | Alphanumeric string identifying a token. |

### Revoke a token

**DELETE** `/tokens/{token_id}`

Revoke a specific token by its id.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `token_id` | string | path | Yes | Alphanumeric string identifying a token. |