Get a token
Gets one token by its auth_id. Use me to see the token you are calling with, for example to read its permissions or its expiry.
Any token may read itself with me, including a limited token. To read another token you need a secret or trusted token with the auths read permission. A test token cannot read a live token (404).
AuthorizationBearer <token>A secret, trusted or limited token. See Authentication.
auth_id*stringThe token's auth_id, which is the SHA-256 hash of the full token in lower-case hex. Never put the full token in a URL. Use me for the token you call with.
expand?stringComma-separated child objects to return in full instead of as a URL, for example customer,payments. Use dot notation for nested objects (items.product), up to four levels deep. A single object takes up to 12 paths; a list takes up to 2, applied to every item. Extra paths are dropped without an error. See Expanding objects.
formatted?booleanWhen true, the object also has a formatted child with amounts and dates as display text in the shopper's language and currency (for example $19.99 or November 7, 2026). The default is false. See Localized formatting.
falseshow?stringComma-separated fields to return; all others are left out. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
hide?stringComma-separated fields to leave out of the response. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
timezone?stringAn IANA time zone name, such as America/New_York or UTC. It sets how date_start and date_end are read and the time zone of every date in the response. The default is the account's time zone (Settings, Technical), or UTC when it has none. A name that is not known is a 400.
The token, with a masked token value.
application/json- response
An API token. The full token is shown only once, in the response that creates it. After that token holds a masked copy. A token's auth_id is the SHA-256 hash of the full token, so you can look a token up without sending it.
Test or live mode comes from the token. A token whose test is true reads and writes only test data, and a live token only live data. There is no test header. The test query parameter only counts when you create a token (such as POST /auths/secret or POST /auths/limited), where it picks the mode of the new token.
object?"auth"The object type. Always auth.
"auth"url?stringThe URL of this token.
uriauth_id?stringThe SHA-256 hash of the full token, in lower-case hex.
test?booleanTrue for a test token. A test token reads and writes only test data.
account_id?stringThe account the token belongs to.
account_alias?|The alias of the account the token belongs to.
type?stringThe token type. secret is for your server. trusted belongs to a signed-in dashboard user and is used in the browser. limited is used in the browser by shoppers. admin, app and service are used by Comecero itself and are not issued to integrators.
"secret""trusted""limited""admin""app""service"ip_address?|The IP address the token was issued to. Set for trusted and limited tokens, null for secret tokens.
token?stringThe full token in the response that creates it. Every other response gives a masked copy, such as secret.live.Kd4...9f2a. The full token starts with its type and its mode, for example secret.live. or limited.test..
expires?|When the token stops working. Null when it never expires. Trusted and limited tokens move this date forward each time they are used.
date-timeexpires_in_seconds?|Seconds until expires. Null when the token never expires.
date_last_used?|The day a secret token was last used, updated at most once a day. Null for other token types and for a token never used.
date-timecomments?|Your own label for the token, up to 250 characters.
length <= 250date_created?stringWhen the token was created.
date-timedate_modified?stringWhen the token was last changed.
date-timecustomer?|The customer a limited token was made for, as a URL, or the customer object when you send expand=customer. Only present on a token made for a customer.
user?|The user a trusted token belongs to, as a URL, or the user object when you send expand=user. Only present on a token tied to a user.
roles?array<string>The role_id of each role given to the token.
permissions?array<>The permissions given to the token directly.
effective_permissions?What the token or user may really do, after its roles and permissions are combined and cut down to what its token type allows. Each key is a resource and each value says which methods are allowed on it.
browser_info?Details about the caller's browser, read from the request headers. Only in the response that creates a token, and only when you send browser_info=true.
formatted?Display text for the dates. Only present when you send formatted=true.
curl -X GET 'https://api.comecero.com/api/v1/auths/me'{ "object": "auth", "url": "https://api.comecero.com/api/v1/auths/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "auth_id": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "test": true, "account_id": "AB1234", "account_alias": "example-shop", "type": "secret", "ip_address": null, "token": "secret.test.Hq7...4c1e", "expires": null, "expires_in_seconds": null, "date_last_used": "2026-11-06T00:00:00Z", "comments": "Order sync server", "date_created": "2026-10-01T14:36:52Z", "date_modified": "2026-10-01T14:36:52Z", "roles": [], "permissions": [ { "resource": "orders", "methods": [ "read" ], "allow": true } ], "effective_permissions": { "orders": { "create": false, "read": true, "update": false, "delete": false } }}Create a test trusted token POST
Swaps a live trusted token for a test trusted token with the same user and permissions. Use it when a signed-in user switches the dashboard or your own tool to test mode. You cannot ask for any other kind of trusted token. Trusted tokens are given to users when they sign in, not created through the API. Send `test=true` in the query string (`400` without it) and no request body (`403` with one). The token you call with must be a live trusted token (`403` otherwise). The new token lasts two hours from its last use.
Update a token POST
Changes a secret token's label, expiry, roles or permissions. Only the fields you send change. Sending `roles` or `permissions` replaces that whole list. Trusted and limited tokens cannot be changed (`400`). The token you call with must hold every permission the updated token will have (`403` otherwise), and only a live token may change a live token. Secret and trusted tokens may call this with the `auths` update permission. This is true for `me` too: a token may not widen its own permissions.