API tokens
GET
Tokens agents use to work in this workspace through Roster's MCP server. Your own; owners and admins see everyone's. Never the token itself: only its first characters, and when it was last used. Made and revoked in the app only.
sessioncookie
better-auth.session_token<token>Set by POST /api/auth/sign-in/email.
ws*stringThe workspace id (from GET /api/me).
The tokens, newest first.
application/jsoncurl -X GET 'https://app.useroster.work/api/workspaces/string/api-tokens'Example Response
{ "tokens": [ { "id": "7c1d…", "workspaceId": "ws_1", "userId": "u_1", "name": "Claude Code on my laptop", "scope": "user", "prefix": "rst_u_3kf9", "lastUsedAt": "2026-11-09T10:12:00.000Z", "revokedAt": null, "createdAt": "2026-11-09T09:00:00.000Z" } ]}