# client.tokens

> client.tokens — the tokens operations.

`client.tokens` — the `tokens` operations.

On `AsyncKindgi` every method is the same, awaited.

## `client.tokens.list()`

```python signature
list(
    *,
    cursor: str | None = None,
    limit: int | None = None,
    principal: str | None = None,
    timeout: float | None = None,
) -> ApiTokenPage
```

List API keys. `GET /v1/tokens`

Newest first. Never returns secrets. A tenant admin sees every key (`?principal=` for one principal's); anyone else sees their own.

## `client.tokens.mint()`

```python signature
mint(
    body: MintTokenBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintTokenResult
```

Mint an API key. `POST /v1/tokens`

An API key acts for one principal (`for`: a person or a service account; default the caller), with that principal's grants. Its `role` is a ceiling under them and its `projectId` a limit. Returns the plaintext token exactly once. A person or a service account's key mints its own keys; only a tenant admin mints for someone else, or an `admin` key. A caller can only grant capabilities it holds, and a key limited to a project mints only keys limited to it. A key that expires mints only keys that expire no later than it, and a session opened by token sign-in mints as the key it was opened with. Only mounted when the deployment supplies a `TokenAdmin`.

## `client.tokens.get()`

```python signature
get(token_id: str | UUID, /, *, timeout: float | None = None) -> ApiToken
```

Read an API key. `GET /v1/tokens/{tokenId}`

Never returns the secret. A tenant admin reads any key; anyone else only their own (someone else's reads as missing).

## `client.tokens.revoke()`

```python signature
revoke(
    token_id: str | UUID,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
) -> RevokeTokenResult
```

Revoke an API key. `POST /v1/tokens/{tokenId}/revoke`

Takes effect on the next request. A tenant admin revokes any key; anyone else only their own.

## `client.tokens.mint_public()`

```python signature
mint_public(
    body: MintPublicRunTokenBody | Mapping[str, Any] | None = None,
    /,
    *,
    idempotency_key: str | None = None,
    timeout: float | None = None,
    **fields: Any,
) -> MintPublicRunTokenResult
```

Mint a public run token. `POST /v1/tokens/public`

A short-lived, read-only token for up to 50 runs (and their descendants), to hand to a browser: it can only call `GET /v1/runs/{runId}/progress` and `GET /v1/runs/{runId}/progress/stream`. Stateless: it cannot be revoked one by one, so keep lifetimes short. Mounted when the deployment issues public run tokens.