Pro API Tokens

Create long-lived API tokens for server-to-server integrations. Unlike JWT tokens, API tokens don't expire until revoked.

List Tokens

GET /pro/api/tokens

Request

curl https://api.mail.cx/pro/api/tokens \
  -H "Authorization: Bearer tm_pro_xxxxxxxxxxxx"

Response 200

{
  "tokens": [
    {
      "id": "t1o2k3e4-n5i6-d7e8-9012-abcdef123456",
      "name": "Production Server",
      "last_used_at": "2025-01-15T10:30:00Z",
      "created_at": "2025-01-10T08:00:00Z",
      "revoked_at": null
    },
    {
      "id": "t2o3k4e5-n6i7-d8e9-0123-bcdef2345678",
      "name": "Staging",
      "last_used_at": null,
      "created_at": "2025-01-12T14:00:00Z",
      "revoked_at": "2025-01-14T09:00:00Z"
    }
  ]
}

Field	Type	Description
id	uuid	Token ID
name	string	Display name
last_used_at	string?	Last time the token was used (null if never)
created_at	string	Creation timestamp
revoked_at	string?	Revocation timestamp (null if active)

---

Create a Token

POST /pro/api/tokens

Request

curl -X POST https://api.mail.cx/pro/api/tokens \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production Server"}'

Field	Type	Required	Description
name	string	Yes	Display name for the token

Response 201

{
  "id": "t1o2k3e4-n5i6-d7e8-9012-abcdef123456",
  "name": "Production Server",
  "token": "tm_pro_aBcDeFgHiJkLmNoPqRsTuVwXyZ123456"
}

WARNING

The token value is only shown once at creation. Copy and store it securely — it cannot be retrieved later.

Usage

Use the token in the Authorization header for any Pro endpoint:

curl https://api.mail.cx/pro/api/accounts \
  -H "Authorization: Bearer tm_pro_aBcDeFgHiJkLmNoPqRsTuVwXyZ123456"

---

Revoke a Token

DELETE /pro/api/tokens/{id}

Immediately invalidates the token. Any requests using this token will receive 401.

Request

curl -X DELETE https://api.mail.cx/pro/api/tokens/t1o2k3e4-... \
  -H "Authorization: Bearer tm_pro_xxxxxxxxxxxx"

Response 204

No content. The token is permanently revoked.