token is returned masked: the first 2 and last 2 characters, with asterisks between. Send include-secret=yes to get the whole value; that read is recorded in the access log. Every row also carries token-hash, the SHA-256 of the token, which you can use in place of the token to read or revoke it.{
"token": "3c****************************79",
"token-hash": "1b34d5bff5b863962dca217fc9107f9d7877c65c353b88445fdd7a5a5d6fc73e",
"client-id": "app.example.com",
"reseller": "example-reseller",
"domain": "example.com",
"user-id": "1001@example.com",
"expires-datetime": "2026-10-07T15:30:00+00:00",
"expired": "yes",
"user-scope": "Office Manager",
"token-type": "access",
"mask-chain": ""
}