Documentation / API Authentication / Revoking Tokens

Revoking Tokens

Revoking Tokens for PanelConfig API consumers and operators.

The database model supports token status through the status column. The current inspected PCAdmin token screen lists tokens and creates them, but no dedicated revoke action was found in that file. Treat revocation UI as planned unless your deployed build contains it.

Procedure

  1. Generate or identify the token in PCAdmin.
  2. Send a validation request to /api/v1/me.php.
  3. Confirm that the JSON envelope contains success: true.
  4. Move the token into the final secret storage location.
  5. Review request logs after the integration starts using the API.

Example

curl -i https://panel.example.com/api/v1/me.php \
  -H "Authorization: Bearer pc_YOUR_TOKEN" \
  -H "Accept: application/json"

Troubleshooting

  • Check that the web server forwards the Authorization header to PHP.
  • Make sure the token starts with the copied pc_ value and has not been cut off.
  • Confirm the token has not expired.
  • Confirm the user attached to the token is still active.

Audit Logging

Token creation calls the audit helper. Authenticated API requests update last_used_at and insert request records into api_requests when the table exists.

← Token Rotation Authentication Errors →