Personal Access Tokens

Create, list, and revoke the personal access tokens that authenticate Blue API requests.

Personal access tokens (PATs) are the programmatic credentials behind Blue’s API authentication. This section is the API-reference complement to the UI walkthrough in Getting Started > Authentication: it documents how to create, list, and revoke tokens via GraphQL.

A token has two parts:

  • Token ID — the unprefixed uid, sent as the X-Bloo-Token-ID header.
  • Secret — the pat_-prefixed value, sent as the X-Bloo-Token-Secret header.

The Secret is shown exactly once, at creation. Blue stores only a bcrypt hash of it, so it can never be retrieved again — capture it when the create mutation returns it.

Token management needs a user session

All three operations require an authenticated user session (the Firebase/JWT login used by the app). They cannot be performed while authenticating with a token itself — calling them with X-Bloo-Token-ID headers present returns FORBIDDEN. Generate, audit, and revoke tokens from a logged-in browser session, not from an API integration.

In the API, a token is a PersonalAccessToken object. The list query returns a PersonalAccessTokenPagination wrapper (items + pageInfo). Tokens are always scoped to the calling user — you only ever see and manage your own.

Operations

OperationTypeDescription
Create a TokenMutationcreatePersonalAccessToken — generate a token and read its Secret (the only time it’s returned).
List TokensQuerypersonalAccessTokens — page through your own tokens to audit names, expiry, and last-used dates.
Revoke a TokenMutationdeletePersonalAccessToken — delete a token by ID; it stops authenticating immediately.
  • Authentication — the in-app flow for generating a token and the X-Bloo-* request headers.
  • Making Requests — how to send authenticated GraphQL requests with curl, Python, or Node.