Skip to content
Docs

Make an API token

POST
/api/workspaces/{ws}/api-tokens

The token acts as you, with your role in this workspace as it is at each call, in this workspace only. It's shown once, in token; Roster keeps only a hash. Made in the app only, never by an agent.

Authorization

session
cookiebetter-auth.session_token<token>

Set by POST /api/auth/sign-in/email.

Path Parameters

ws*string

The workspace id (from GET /api/me).

Request Body

application/json
  1. body
name*string

What it is for: "Claude Code on my laptop".

Length1 <= length <= 80

Response Body

The token, shown this once.

application/json
Example Request
curl -X POST 'https://app.useroster.work/api/workspaces/string/api-tokens' \  -H 'Content-Type: application/json' \  -d '{  "name": "string"}'
Example Response
{  "id": "7c1d…",  "name": "Claude Code on my laptop",  "scope": "user",  "prefix": "rst_u_3kf9",  "token": "rst_u_3kf9…"}

API tokens GET

Tokens agents use to work in this workspace through Roster's MCP server. Your own; owners and admins see everyone's. Never the token itself: only its first characters, and when it was last used. Made and revoked in the app only.

Revoke an API token DELETE

Your own; owners and admins can revoke anyone's. It stops working at once.