3x-uiAPI Tokens
Manage scoped Bearer tokens for programmatic auth. Tokens grant admin, monitor, or node-sync access, may expire, and are stored as SHA-256 hashes. The plaintext is returned only once at creation.
API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
In: header
Response Body
application/json
curl -X GET "https://example.com/panel/api/setting/apiTokens"{ "success": true, "obj": [ { "id": 1, "name": "default", "enabled": true, "createdAt": 1736000000 } ]}API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/panel/api/setting/apiTokens/create" \ -H "Content-Type: application/json" \ -d '{ "name": "central-panel-a", "scope": "node-sync", "expiresAt": 1798761600000 }'{ "success": true, "obj": { "createdAt": 1736000000, "enabled": true, "expiresAt": 0, "id": 2, "name": "central-panel-a", "scope": "admin", "token": "new-token-string" }}API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
In: header
Path Parameters
Token row ID.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/panel/api/setting/apiTokens/delete/0" \ -H "Content-Type: application/json" \ -d '{ "expectedScope": "node-sync" }'{ "success": true}API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.
In: header
Path Parameters
Token row ID.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/panel/api/setting/apiTokens/setEnabled/0" \ -H "Content-Type: application/json" \ -d '{ "enabled": false, "expectedScope": "node-sync" }'{ "success": true}