API keys API

Creating a token returns the secret in token.sKey. A list returns maskedKey instead. An owner can retrieve one token by id and receive its full sKey. Treat the value as a password and keep it out of source control and client-side code.

Endpoints

Method	Path	What it does
GET	`/api/users/tokens`	List tokens
GET	`/api/users/tokens/:tokenId`	Read a token
POST	`/api/users/tokens`	Create a token
DELETE	`/api/users/tokens/:tokenId`	Delete a token

List tokens

GET /api/users/tokens lists the tokens for the signed-in user.

Request

curl -X GET "https://api.requestrocket.com/api/users/tokens" \
  -H "Authorization: u-your-token"

import axios from "axios";

const response = await axios.request({
  method: "GET",
  url: "https://api.requestrocket.com/api/users/tokens",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "GET",
    "https://api.requestrocket.com/api/users/tokens",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("GET", "https://api.requestrocket.com/api/users/tokens", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/tokens"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "tokens": [
    {
      "tokenId": "3f6c2a52-0c1c-4a52-9a6a-2f0f8d3d5b11",
      "tokenName": "CI",
      "maskedKey": "u-9d****4d5e",
      "createdAt": "2026-11-02T07:30:00.000+00:00",
      "expiresAt": "2027-06-30T00:00:00Z"
    }
  ]
}

Returns every token for the signed-in user. Each item carries a maskedKey. The secret is not in this list.

Query parameters

None.

Response attributes

Attribute	Type	Description
`tokens`	array	Tokens for the signed-in user.
`tokens[].tokenId`	string	Id used to delete the token.
`tokens[].tokenName`	string	Name given when the token was created.
`tokens[].maskedKey`	string	Masked secret. The full value is not returned here.
`tokens[].createdAt`	string	ISO 8601 creation time.
`tokens[].expiresAt`	string or null	Expiry time, or null when the token does not expire.

Create a token

POST /api/users/tokens creates a token. tokenName is required. expiresAt is optional and must be an ISO date in the future. The value is returned in sKey; an owner can also retrieve it later with the single-token GET route. It is the u- credential.

Request

curl -X POST "https://api.requestrocket.com/api/users/tokens" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{"tokenName":"CI","expiresAt":"2027-06-30T00:00:00Z"}'

import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/users/tokens",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {"tokenName":"CI","expiresAt":"2027-06-30T00:00:00Z"}
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/users/tokens",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\"tokenName\":\"CI\",\"expiresAt\":\"2027-06-30T00:00:00Z\"}"
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{"tokenName":"CI","expiresAt":"2027-06-30T00:00:00Z"}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/users/tokens", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/tokens"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\"tokenName\":\"CI\",\"expiresAt\":\"2027-06-30T00:00:00Z\"}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "message": "Token created successfully",
  "token": {
    "tokenId": "3f6c2a52-0c1c-4a52-9a6a-2f0f8d3d5b11",
    "tokenName": "CI",
    "sKey": "u-9d1b7c3e-2b7e-4a1f-8c55-6f1a2b3c4d5e",
    "createdAt": "2026-11-02T07:30:00.000+00:00",
    "expiresAt": "2027-06-30T00:00:00Z"
  }
}

{
  "message": "tokenName is required"
}

Request body

Parameter	Type	Required	Description
`tokenName`	string	✓	Name for the token. A blank value is rejected.
`expiresAt`	string		ISO 8601 time in the future. Omit it for a token that does not expire.

Returns the new token. token.sKey is the secret.

Response attributes

Attribute	Type	Description
`message`	string	`Token created successfully`.
`token.tokenId`	string	Id used to delete the token.
`token.tokenName`	string	Name from the request.
`token.sKey`	string	Secret. Send it as the `Authorization` value.
`token.createdAt`	string	ISO 8601 creation time.
`token.expiresAt`	string or null	Expiry from the request, or null when the token does not expire.

Delete a token

DELETE /api/users/tokens/:tokenId deletes that token. There is no request body.

Request

curl -X DELETE "https://api.requestrocket.com/api/users/tokens/:tokenId" \
  -H "Authorization: u-your-token"

import axios from "axios";

const response = await axios.request({
  method: "DELETE",
  url: "https://api.requestrocket.com/api/users/tokens/:tokenId",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);

import requests

response = requests.request(
    "DELETE",
    "https://api.requestrocket.com/api/users/tokens/:tokenId",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("DELETE", "https://api.requestrocket.com/api/users/tokens/:tokenId", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/users/tokens/:tokenId"))
            .method("DELETE", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "message": "Token deleted successfully"
}

{
  "message": "Unauthorized to delete this token"
}

Returns message set to Token deleted successfully.

Rotate a token

Create a replacement, update the integration, verify it with a Core API call, then delete the old token by tokenId. Deleting a token revokes it; there is no endpoint that changes an existing secret.

App guide

Do this in the app

Get started

Create the first proxy or MCP server

Profile

Display name and personal settings

Sign in

How to sign in to the platform

Endpoints

List tokens

Request

Responses

Query parameters

Response attributes

Create a token

Request

Responses

Request body

Response attributes

Delete a token

Request

Responses

Rotate a token

Next

App guide

Get started

Profile

Sign in

On this page