Accounts & authentication

List your CLI logins and browser sessions

GET /api/v1/auth/tokens

Lists your active CLI logins and browser sessions. People only: their own CLI logins and browser sessions that still work, newest first, with when each was last used. current marks this request's sign-in, and revocable marks older sign-ins it can end.

Example request

curl --request GET 'https://commitscale.com/api/v1/auth/tokens' \
  --header "Authorization: Bearer $CSCALE_TOKEN"

Example values illustrate the format. Use your own credentials and identifiers.

Responses

200 The tokens.

application/json

{
  "tokens": [
    {
      "created_at": "2026-10-26T10:00:00Z",
      "current": false,
      "expires_at": "2026-10-26T10:00:00Z",
      "id": 1,
      "kind": "cli",
      "revocable": false,
      "token": "cs_pat_3f9a…"
    }
  ]
}

tokensrequired · array of object

The person's sign-in credentials, without their secret values.

Fields of tokens

The person's sign-in credentials, without their secret values.

Each item has this shape.

One of the caller's own tokens that still works.

created_atrequired · string (date-time): When this record was created, in UTC.
currentrequired · boolean: Whether this request came with it.
expires_atrequired · string (date-time): When this credential or request expires, in UTC.
idrequired · integer (int64): What to revoke it by.
kindrequired · cli / browser: Credential kind, such as a personal token or browser session.
last_used_atoptional · string (date-time): When this credential was last used, in UTC. Absent until its first use.
revocablerequired · boolean: Whether this sign-in may revoke it: only one older than itself, so a fresh sign-in always wins. A browser opened with cscale web is as old as the CLI login it came from.
signed_in_withoptional · string: For a browser, how it signed in: email_link, passkey, oidc, or cscale_web, a session that ends with the CLI login it came from.
tokenrequired · string: Its first characters, such as cs_pat_3f9a….

RateLimit and RateLimit-Policy describe the request rate. Follow Retry-After when a response asks you to wait.

Problem responses

Errors use application/problem+json. Act on the stable code, and follow next when present. See the problem format.

check_key_scope403

A check-only key may call the test check, read its own usage and acceptance rule, contact support, and withdraw data sharing.

Use a person's sign-in for account management. More agent power needs the owner's passkey; this key cannot widen itself.

feature_off403

The namespace plan does not include this feature.

Retrying on the same plan will not help. GET /api/v1/namespaces/{namespace}/plan, and the namespace's Plan page in Settings, show what its plan includes.

unauthenticated401

The request carried no credentials.

Use this operation's sign-in method. Bearer credentials use Authorization: Bearer <token>; browser credentials use the session cookie.

invalid_token401

The token is unknown, expired, or revoked, its agent was revoked, or an OAuth token was used outside its MCP resource.

Stop using it. Sign in again, or ask the owner to create a replacement agent key.

forbidden403

The caller may not do this: only people may, only owners may, or the agent was not given this repository or write access.

Stop. Retrying will not help. Ask the owner for the access, or leave the step to a person.

quota_exceeded429

With 429, the caller used its requests for the minute. With 422, a count limit was reached.

With 429, wait Retry-After seconds and retry. With 422, remove one first.

internal500

The server failed, and logged why.

Retry after Retry-After seconds. A write is safe to retry with the same idempotency key.