List public tokens
Returns the public token of every environment, including the full token. If an environment has no token yet, this request creates one.
Requires a management key.
bearerAuthorizationBearer <token>Send a credential in the Authorization header: Authorization: Bearer <token>.
Each credential belongs to one environment of one workspace, so the API never takes a workspace or environment in the URL.
- Management key (
ffk_…, secret): manages flags, segments, environments, and API keys, and reads the audit log and analytics. It can also do everything an evaluation key can. - Evaluation key (
ffk_…, secret): for server SDKs. It evaluates flags, reads flag definitions for local evaluation, and sends telemetry. - Public token (
ffp_…, not secret): for browser and mobile apps. It evaluates flags through OFREP and sends telemetry. It cannot read flag definitions.
Keep secret keys on your server. A 401 response means the credential is missing or not valid. A 403 response means the credential is valid but its role cannot perform the operation.
OK
application/json- response
[index: integer]?A public client token. Each environment has exactly one. It can evaluate flags through OFREP and send telemetry, but it cannot read flag definitions or change anything. This makes it safe to use in browser and mobile apps.
curl -X GET 'https://api.toggld.io/api/v1/public-tokens'[ { "id": "pub_c2e5f8a1-7d3b-4c6e-a9f2-0b4d7e1a3c5f", "tenantId": "t_5b9e2c4a-8f1d-4a7c-b3e6-9d0c2f5a8b1e", "environmentId": "env_3f6b2a9c-1d4e-4f7a-8b2c-5e9d0a1f3c7b", "token": "ffp_L31673RN3zCafb2rO5fksLQ99BMjgG5I", "createdAt": "2026-05-01T12:00:00.000Z" }]Revoke an API key DELETE
Permanently revokes a secret API key. Requests that use it then fail with `401`. It can take a short time for the key to stop working everywhere. Requires a management key. Returns `404` if no key has this ID.
List audit events GET
Returns up to 100 of the most recent configuration changes in the workspace, newest first. Use the query parameters to filter the events. When you combine filters, an event must match all of them. Requires a management key.