Tokens API

The Tokens API allows you to retrieve CLI tokens for your user profile and app environments. These are sensitive operations that require appropriate permissions.

Make sure to read the Get Started document to understand how the API works.

OAuth grants cannot return legacy credentials

OAuth access tokens, whether used with the Public API or through MCP, cannot retrieve long-lived CLI tokens or raw MCP key material. A revocable OAuth grant must never be able to create or reveal a legacy credential that would continue working after the grant is revoked. Use the OAuth access token directly for OAuth integrations.

Get User Token

Retrieves the decoded CLI token for the authenticated user. This is the token used for CLI authentication and API access.

Endpoint: GET /api/public/v1/user/token

Permissions:

• Requires user authentication
• For MCP requests: requires the quave:read:secrets and quave:reveal:cli-tokens scopes. The user token works outside MCP with all your permissions, so quave:read:secrets alone answers 403

Audit: the token works on every account you belong to, so each reveal is recorded as a "Secret decrypted" event (secret type USER_CLI_TOKEN) in the Audit of each of those accounts. All rows of one reveal share a revealId, and a reveal made through MCP also records the MCP key id, key name and tool.

Example Request

curl -X GET \
    -H 'Authorization: YOUR_TOKEN' \
    'https://api.quave.cloud/api/public/v1/user/token'

Example Response

{
  "token": "your-decoded-cli-token-value",
  "username": "johndoe",
  "email": "john@example.com",
  "cliTokenGeneratedAt": "2025-01-15T10:30:00.000Z"
}

Response Fields

Field	Type	Description
token	String	The decoded CLI token value.
username	String	The username of the authenticated user.
email	String	The email of the authenticated user.
cliTokenGeneratedAt	Date	When the token was generated.

---

Get App Environment Token

Retrieves the decoded CLI token for a specific app environment. Requires Secrets Access permission on the account that owns the environment.

Endpoint: GET /api/public/v1/app-env/token

Permissions:

• Requires Secrets Access permission on the account
• For MCP requests: requires the quave:read:secrets and quave:reveal:cli-tokens scopes, because the environment token works outside MCP to deploy, scale and set images
• Each reveal is recorded in the environment's account Audit as a "Secret decrypted" event (secret type APP_ENV_CLI_TOKEN), with the MCP key id, key name and tool when it came through MCP

Query Parameters

Parameter	Type	Required	Description
appEnvId	String	Either	The ID of the app environment.
envName	String	Either	The CLI environment name (alternative to appEnvId).

Example Request

curl -X GET \
    -H 'Authorization: YOUR_TOKEN' \
    'https://api.quave.cloud/api/public/v1/app-env/token?appEnvId=5f7b1b7b7b7b7b7b7b7b7b7b'

Example Response

{
  "token": "decoded-app-env-cli-token-value",
  "appEnvId": "5f7b1b7b7b7b7b7b7b7b7b7b",
  "cliEnvName": "production",
  "name": "Production",
  "cliTokenGeneratedAt": "2025-01-15T10:30:00.000Z"
}

Response Fields

Field	Type	Description
token	String	The decoded CLI token value for the environment.
appEnvId	String	The app environment ID.
cliEnvName	String	The CLI environment name.
name	String	The display name of the environment.
cliTokenGeneratedAt	Date	When the token was generated.

Secret revelation requires the account-level Secrets Access role; Admin alone does not grant it. Existing authentication, resource-access, MFA and API/MCP scope requirements still apply. See User Roles.