List tokens
Lists the tokens of your account in the mode of the token you call with: a test token lists test tokens, a live token lists live tokens. The list is offset-based. Each token shows a masked token, never the full value.
To find one token, send the full token in q. You get that token, or an empty list.
Secret and trusted tokens may call this with the auths read permission.
AuthorizationBearer <token>A secret, trusted or limited token. See Authentication.
limit?integerHow many items to return on one page, from 1 to 100. The default is 100. A value outside 1 to 100, or one that is not a whole number, is a 400.
1 <= value <= 100100offset?integerFor offset-based lists, how many items to skip before the page starts. Use next_page_offset or previous_page_offset from the page you have. A value that is not a whole number is a 400.
0 <= value0sort_by?stringThe field to sort by. The default is date_created.
"date_created""date_created""date_modified""auth_id"desc?booleanSort in descending order (newest, largest or last first) when true. The default is false. A value other than true or false is a 400.
falseq?stringA full token. Returns only that token.
expand?stringComma-separated child objects to return in full instead of as a URL, for example customer,payments. Use dot notation for nested objects (items.product), up to four levels deep. A single object takes up to 12 paths; a list takes up to 2, applied to every item. Extra paths are dropped without an error. See Expanding objects.
formatted?booleanWhen true, the object also has a formatted child with amounts and dates as display text in the shopper's language and currency (for example $19.99 or November 7, 2026). The default is false. See Localized formatting.
falseshow?stringComma-separated fields to return; all others are left out. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
hide?stringComma-separated fields to leave out of the response. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
timezone?stringAn IANA time zone name, such as America/New_York or UTC. It sets how date_start and date_end are read and the time zone of every date in the response. The default is the account's time zone (Settings, Technical), or UTC when it has none. A name that is not known is a 400.
An offset-based list of tokens.
application/json- response
An offset-based list of tokens.
total_items*integerHow many items match, across all pages.
total_pages*integerHow many pages there are at this limit. 0 when nothing matches.
current_page*integerThe number of this page, starting at 1. 0 when nothing matches.
next_page_url*|The URL of the next page, or null on the last page.
urinext_page_offset*|The offset of the next page, or null on the last page.
previous_page_url*|The URL of the previous page, or null on the first page.
uriprevious_page_offset*|The offset of the previous page, or null on the first page.
current_page_url*stringThe URL of this page.
uridata*array<>The tokens on this page.
curl -X GET 'https://api.comecero.com/api/v1/auths'{ "total_items": 1, "total_pages": 1, "current_page": 1, "next_page_url": null, "next_page_offset": null, "previous_page_url": null, "previous_page_offset": null, "current_page_url": "https://api.comecero.com/api/v1/auths", "data": [ { "object": "auth", "url": "https://api.comecero.com/api/v1/auths/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "auth_id": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "test": true, "account_id": "AB1234", "account_alias": "example-shop", "type": "secret", "ip_address": null, "token": "secret.test.Hq7...4c1e", "expires": null, "expires_in_seconds": null, "date_last_used": "2026-11-06T00:00:00Z", "comments": "Order sync server", "date_created": "2026-10-01T14:36:52Z", "date_modified": "2026-10-01T14:36:52Z", "roles": [], "permissions": [ { "resource": "orders", "methods": [ "read" ], "allow": true } ], "effective_permissions": { "orders": { "create": false, "read": true, "update": false, "delete": false } } } ]}Overview
Previous Page
Create a limited token POST
Creates a limited token for a shopper's browser. A limited token works like a session: it can read your public catalog, and it can change only the carts, payments and other objects it created itself. Call it without an `Authorization` header from the browser, with your `account_id` in the query string (`400` without it). The new token is live. To get a test token this way, add `test=true`. That works only when your account allows limited test tokens without a token (Settings, Technical, `allow_public_limited_test_tokens`); otherwise the answer is `403`. Your server may also call it with a secret or trusted token that may create tokens. Then `account_id` is optional (it must match the token, `400` otherwise), the new token takes the mode of your token unless you send `test`, and you may send a `customer_id` to make the token for one customer. A limited token in the header is refused (`403`): to get a new one, call without a header. A new limited token lasts two hours. Each use moves the expiry forward, and a token that keeps being used lasts longer: 12 hours for its first uses, 24 hours after 5 uses and 15 days after 10 uses.