List personal access tokens
Lists the authenticated user's active (non-revoked) PATs. Plaintext is never returned; only metadata. PAT callers need `read` scope.
AuthorizationBearer <token>Personal access token for non-browser clients. Mint at Settings → API Tokens. Carries one of two scopes: read (list/get Routes, export GPX, profile) or write (read plus metadata-only mutations on owned routes and on preferences). Blocked from /admin/* and from DELETE /users/me. Destructive operations require X-Routess-Confirm: true and return 428 PRECONDITION_REQUIRED otherwise. See ADR-0022 and ADR-0023.
Tokens retrieved
application/json- response
[index: integer]?curl -X GET 'https://api.routess.com/auth/tokens'[ { "id": 42, "label": "Backup script (laptop)", "scope": "read", "lastUsedAt": "2026-05-14T10:23:00Z", "expiresAt": "2027-01-01T00:00:00Z", "createdAt": "2026-05-10T08:00:00Z" }]Logout current session
Revokes the current JWT session
Mint a personal access token
Creates a new PAT for the authenticated user. Returns the plaintext exactly once; it is hashed at rest and cannot be retrieved again. Tokens authenticate non-browser clients (CLI, AI agents, scripts) via `Authorization: Bearer routess_pat_…`. Minting is cookie-only: PATs cannot mint other PATs. PATs are blocked from `/v1/admin/*` and from `DELETE /v1/users/me` regardless of the owner's role.