User GuideDeveloper DocsAPI Reference
EndpointsAuth

Mint a personal access token

Creates a new PAT for the authenticated user. Returns the plaintext exactly once; it is hashed at rest and cannot be retrieved again. Tokens authenticate non-browser clients (CLI, AI agents, scripts) via `Authorization: Bearer routess_pat_…`. Minting is cookie-only: PATs cannot mint other PATs. PATs are blocked from `/v1/admin/*` and from `DELETE /v1/users/me` regardless of the owner's role.

POST
/auth/tokens

Authorization

JWT-auth
headerAuthorizationBearer <token>

Request Body

application/json
  1. body
label*string

Human-readable label so the user can identify the token later in the Settings list. Not displayed to anyone but the owning user.

Length1 <= length <= 80
scope*string

Scope of the token. read covers list/get/export and reading the profile. write adds metadata-only mutations on owned routes and on user preferences.

Value in"read""write"
expiresAt?string

Optional ISO-8601 expiry. When omitted the token does not expire and lives until the user revokes it.

Response Body

Token created

application/json
  1. response
id*number

Stable identifier used to revoke the token.

label*string

User-supplied label.

scope*string

Scope of the token.

Value in"read""write"
lastUsedAt*|

Most recent time the token was used to authenticate a request, or null if never used since creation.

expiresAt*|

Expiry timestamp, or null if the token has no expiry.

createdAt*string

Creation timestamp.

token*string

The plaintext bearer token. Returned exactly once at creation time; the API does not store it and there is no way to retrieve it later. If you lose it, revoke the token and mint a new one.

curl -X POST 'https://api.routess.com/auth/tokens' \  -H 'Content-Type: application/json' \  -d '{  "label": "Backup script (laptop)",  "scope": "read"}'
{  "id": 42,  "label": "Backup script (laptop)",  "scope": "read",  "lastUsedAt": "2026-05-14T10:23:00Z",  "expiresAt": "2027-01-01T00:00:00Z",  "createdAt": "2026-05-10T08:00:00Z",  "token": "routess_pat_uK0wXY8Q1nN3pZqV-7gE2tHaB4cMdL5JfRvO6sI"}

List personal access tokens

Lists the authenticated user's active (non-revoked) PATs. Plaintext is never returned; only metadata. PAT callers need `read` scope.

Revoke a personal access token

Revokes the token with the given ID. Idempotent: revoking an already-revoked token succeeds. PAT callers need `write` scope; revoking the token that authenticates the request itself additionally requires X-Routess-Confirm: true, since it locks the caller out.