Tokens
API tokens authenticate requests. Each token carries scopes and an optional expiry. Creating tokens needs an admin token.
The Token object
idstring
Unique id, prefixed
tok_. namestring
Label shown in the dashboard.
scopesarray
Granted scopes, for example
jobs:write. prefixstring
First characters of the secret, to recognise it.
expires_atstring
Expiry, or null.
Create a token
POST/tokens
Returns the secret once, in secret. Tokens start with sxt_live_ or, on a dev server, sxt_test_.
Required scope admin
Request body
namestring required
A label.
scopesarray required
Scopes to grant.
expires_instring optional
Lifetime such as
90d. Omit for no expiry.Request
cURLShell
curl -X POST https://api.sextant.example/v2/tokens \
-H "Authorization: Bearer $SEXTANT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"ci-deploy","scopes":["jobs:write","jobs:read"],"expires_in":"90d"}'NodeTypeScript
const result = await sextant.tokens.create({
name: 'ci-deploy',
scopes: ['jobs:write', 'jobs:read'],
expires_in: '90d',
});PythonPython
result = client.tokens.create(
name="ci-deploy",
scopes=["jobs:write", "jobs:read"],
expires_in="90d",
)GoGo
result, err := client.Tokens.Create(ctx, &sextant.TokenCreateParams{
Name: "ci-deploy",
Scopes: []any{"jobs:write", "jobs:read"},
ExpiresIn: "90d",
})
if err != nil {
return err
}Responses
The token and its secret.
201JSON
{
"id": "tok_71c0de",
"name": "ci-deploy",
"scopes": [
"jobs:write",
"jobs:read"
],
"prefix": "sxt_live_71c0",
"expires_at": "2027-01-01T00:00:00Z",
"last_used_at": "2026-10-20T08:02:44Z",
"created_at": "2026-07-14T09:30:00Z",
"secret": "sxt_live_71c0de5a8e3b4f19a6d2c07be1f45a90"
}List tokens
GET/tokens
Returns tokens without secrets.
Required scope admin
Request
cURLShell
curl https://api.sextant.example/v2/tokens?limit=20 \
-H "Authorization: Bearer $SEXTANT_TOKEN"NodeTypeScript
const result = await sextant.tokens.list({
limit: 20,
});PythonPython
result = client.tokens.list(limit=20)GoGo
result, err := client.Tokens.List(ctx, &sextant.ListParams{Limit: 20})
if err != nil {
return err
}Responses
All tokens.
200JSON
{
"data": [
{
"id": "tok_71c0de",
"name": "ci-deploy",
"scopes": [
"jobs:write",
"jobs:read"
],
"prefix": "sxt_live_71c0",
"expires_at": "2027-01-01T00:00:00Z",
"last_used_at": "2026-10-20T08:02:44Z",
"created_at": "2026-07-14T09:30:00Z"
}
]
}Revoke a token
DELETE/tokens/{token_id}
Revokes the token immediately. Requests using it fail with 401.
Required scope admin
Path parameters
token_idstring required
The token id.
Request
cURLShell
curl -X DELETE https://api.sextant.example/v2/tokens/tok_71c0de \
-H "Authorization: Bearer $SEXTANT_TOKEN"NodeTypeScript
await sextant.tokens.revoke('tok_71c0de');PythonPython
client.tokens.revoke("tok_71c0de")GoGo
if err := client.Tokens.Revoke(ctx, "tok_71c0de"); err != nil {
return err
}Responses
Revoked. No body.
No response body.