> ## Documentation Index
> Fetch the complete documentation index at: https://agno-v2.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Tokens

> Mint, list, and revoke AgentOS service-account tokens from the terminal.

```bash theme={null}
agno tokens create ci-runner
agno tokens list
agno tokens revoke ci-runner
```

`agno tokens` manages [service accounts](https://agno-v2.mintlify.site/agent-os/security/authorization/service-accounts.md) on a running AgentOS: long-lived tokens for CI jobs, scripts, and other non-human callers. On an AgentOS with authorization enabled, the commands need an admin credential from `AGNO_ADMIN_TOKEN` or `OS_SECURITY_KEY` (or an interactive prompt).

## Create

```bash theme={null}
agno tokens create ci-runner --scopes agents:run --scopes sessions:read --expires 30
```

This is the only time you'll see the plaintext token, so save it somewhere safe. There's no way to get it back later.

| Flag | Default | Description |
| - | - | - |
| `--scopes`, `-s` | `agents:run`, `teams:run`, `workflows:run`, `sessions:read`, `config:read` | Scope to grant (repeatable) |
| `--expires` | `90d` | Days until expiry (`90d`, `30`) or `never` |
| `--privileged` | off | Required to grant write, delete, admin, or service\_accounts scopes |
| `--url` | autodiscover | AgentOS base URL |
| `--allow-http` | off | Permit credentials over plaintext HTTP to a non-loopback host |
| `--yes`, `-y` | off | Trust a remote `AGENTOS_URL` from a `.env` file without prompting |
| `--json` | off | Emit a single JSON document, including the token |

Names are lowercase slugs: letters, digits, `-`, and `_`, starting with a letter or digit. If the name already exists, the command fails; revoke the old account first or pick a different name.

## List

```bash theme={null}
agno tokens list
```

The output shows each account's name, token prefix, scopes, expiry, last use, and status. Full tokens are never stored or displayed.

## Revoke

```bash theme={null}
agno tokens revoke ci-runner --yes
```

Revocation is irreversible and takes effect on the account's next request. Interactive runs confirm first; `--yes`, `--json`, and non-TTY runs proceed without prompting.

> [!WARNING]
>
> A client with a live connection keeps using its revoked token until it reconnects, so restart any long-running clients after you revoke.

## Developer Resources

* [Service accounts](https://agno-v2.mintlify.site/agent-os/security/authorization/service-accounts.md)
* [Scopes](https://agno-v2.mintlify.site/agent-os/security/authorization/scopes.md)
* [agnoctl reference](https://agno-v2.mintlify.site/reference/cli/agnoctl.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.