API Token Management

Manage the current user's personal API token, used for server-to-server authentication. All three endpoints require an authenticated user (Bearer token); no workspace is required.

Check API Token Status

GET /wallethero-api/user/api-token

Check whether the current user has an API token. The token value itself is never returned by this endpoint.

Auth: Bearer token (authenticated user).

Example Request

curl "https://api.wallethero.app/wallethero-api/user/api-token" \
  -H "Authorization: Bearer YOUR_TOKEN"

Response (200)

{
  "has_token": true
}

Response Fields

Field	Type	Description
has_token	boolean	Whether an API token exists for this user

SDK

No SDK method — call the REST endpoint directly.

---

Regenerate API Token

POST /wallethero-api/user/api-token/regenerate

Generate a new API token for the current user. The returned token is shown only once. Regenerating invalidates the previous token.

Auth: Bearer token (authenticated user).

Example Request

curl -X POST "https://api.wallethero.app/wallethero-api/user/api-token/regenerate" \
  -H "Authorization: Bearer YOUR_TOKEN"

Response (200)

{
  "message": "API token regenerated successfully",
  "token": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678"
}

Response Fields

Field	Type	Description
message	string	Success message
token	string	The newly generated API token (64-character hex string)

Important

Store this token securely. It is only shown once. If you lose it, regenerate a new one.

SDK

No SDK method — call the REST endpoint directly.

---

Revoke API Token

DELETE /wallethero-api/user/api-token

Revoke (clear) the current user's API token.

Auth: Bearer token (authenticated user).

Example Request

curl -X DELETE "https://api.wallethero.app/wallethero-api/user/api-token" \
  -H "Authorization: Bearer YOUR_TOKEN"

Response (200)

{
  "message": "API token revoked successfully"
}

SDK

No SDK method — call the REST endpoint directly.

Notes

• API tokens are 64-character hex strings.
• Tokens do not expire but can be regenerated or revoked at any time.
• Use the token in Authorization: Bearer <token> for API requests.