API pipeline: Personal access tokens

Goal: a personal access token, so your own Claude Code, scripts or backend act as you; list and revoke your tokens.

A token sees what you see and may change what you may change. More: Cabi.Chat API — Personal access tokens

Steps

Start from a signed-in session (API pipeline: Sign in to Cabi.Chat with Telegram) or from a token you already hold.

1. Mint.

POST /v0/my/pats
Idempotency-Key: 7c1e…
{"name": "laptop"}
→ {"pat": {"nonce": "<pat>", "title": "laptop", "token_preview": "cabi_pat_1a2b…9f0e", "revoked": false, "created_at": "…"},
   "token": "cabi_pat_…", …}

Keep token: it is shown once.

2. Use.

curl -H "Authorization: Bearer cabi_pat_…" https://api.cabi.chat/v0/my/self
→ 200 {"nonce": "<you>", "first_name": "…", …}

3. List. GET /v0/my/pats → {"pats": [{"nonce", "title", "token_preview", "last_used_at", "revoked", "created_at"}], "total"}. Never the token itself.

4. Revoke. POST /v0/my/pats/<pat>/revoke → the row with "revoked": true. The token stops working on the next request; the row stays.

5. Delete. DELETE /v0/my/pats/<pat> → {"success": true}: revoked and removed from the list.

Behind

• A lost token cannot be shown again: mint a new one and revoke the old.

Rules

• Idempotency-Key is required (400 without it). The same key again → 409: the token is never sent twice.
• Only you manage your tokens, from your own session or a token of yours; an oracle's setup access on your account cannot see, mint or revoke them.
• Revoke a token any time, here or in Profile → Personal access tokens. Revoke the ones you no longer use.

API surface

Index: API pipelines — index