Tokens API

The Tokens API allows you to retrieve CLI tokens for your user profile and app environments. These are sensitive operations that require appropriate permissions.

Make sure to read the Get Started document to understand how the API works.

OAuth grants cannot return legacy credentials

OAuth access tokens, whether used with the Public API or through MCP, cannot retrieve long-lived CLI tokens or raw MCP key material. A revocable OAuth grant must never be able to create or reveal a legacy credential that would continue working after the grant is revoked. Use the OAuth access token directly for OAuth integrations.

Get User Token

Retrieves the decoded CLI token for the authenticated user. This is the token used for CLI authentication and API access.

Endpoint: GET /api/public/v1/user/token

Permissions:

• Requires user authentication
• For MCP requests: requires the quave:read:secrets scope

Example Request

curl -X GET \
    -H 'Authorization: YOUR_TOKEN' \
    'https://api.quave.cloud/api/public/v1/user/token'

Example Response

{
  "token": "your-decoded-cli-token-value",
  "username": "johndoe",
  "email": "john@example.com",
  "cliTokenGeneratedAt": "2025-01-15T10:30:00.000Z"
}

Response Fields

Field	Type	Description
token	String	The decoded CLI token value.
username	String	The username of the authenticated user.
email	String	The email of the authenticated user.
cliTokenGeneratedAt	Date	When the token was generated.

---

Get App Environment Token

Retrieves the decoded CLI token for a specific app environment. Requires admin permission on the account that owns the environment.

Endpoint: GET /api/public/v1/app-env/token

Permissions:

• Requires admin permission on the account
• For MCP requests: requires the quave:read:secrets scope

Query Parameters

Parameter	Type	Required	Description
appEnvId	String	Either	The ID of the app environment.
envName	String	Either	The CLI environment name (alternative to appEnvId).

Example Request

curl -X GET \
    -H 'Authorization: YOUR_TOKEN' \
    'https://api.quave.cloud/api/public/v1/app-env/token?appEnvId=5f7b1b7b7b7b7b7b7b7b7b7b'

Example Response

{
  "token": "decoded-app-env-cli-token-value",
  "appEnvId": "5f7b1b7b7b7b7b7b7b7b7b7b",
  "cliEnvName": "production",
  "name": "Production",
  "cliTokenGeneratedAt": "2025-01-15T10:30:00.000Z"
}

Response Fields

Field	Type	Description
token	String	The decoded CLI token value for the environment.
appEnvId	String	The app environment ID.
cliEnvName	String	The CLI environment name.
name	String	The display name of the environment.
cliTokenGeneratedAt	Date	When the token was generated.