---
title: "List the user's CLI sessions and ephemeral tokens"
description: "Session-only — the Devices page is account-management UI for a logged-in human, so any wbl_* bearer is rejected with INSUFFICIENT_PRIVILEGE (a compromised CLI session must not enumerate sibling devices)."
api_method: GET
api_path: "/v1/users/me/cli-tokens"
canonical_url: https://wiblo.app/docs/developers/api/cli-tokens/list-my-cli-tokens
last_updated: 2026-07-28T17:31:44+02:00
md_url: https://wiblo.app/docs/developers/api/cli-tokens/list-my-cli-tokens.md
---

# List the user's CLI sessions and ephemeral tokens

`GET /v1/users/me/cli-tokens`

Session-only — the Devices page is account-management UI for a logged-in human, so any `wbl_*` bearer is rejected with `INSUFFICIENT_PRIVILEGE` (a compromised CLI session must not enumerate sibling devices). Powers the account-settings Devices and Ephemeral-tokens pages. Returns the user's `cli_tokens` rows (sanitised — no hashes). Per-user rate-limited at 60/60s.

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/users/me/cli-tokens \
  -H "Authorization: Bearer $WIBLO_TOKEN"
```

**TypeScript**

```ts
import { createSdk, listMyCliTokens } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await listMyCliTokens({
  client: sdk,
})
```

## Responses

**`200`** — The user's CLI tokens. Returns `CliTokenListResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `data` | `array<CliTokenSummary>` | Yes |  |

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — A `wbl_*` bearer was presented to a session-only route (`INSUFFICIENT_PRIVILEGE`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.

### The CliTokenSummary object

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | `string` | Yes |  |
| `kind` | `"interactive" \| "ephemeral"` | Yes |  |
| `token_prefix` | `string` | Yes |  |
| `client_id` | `string` | Yes |  |
| `user_agent` | `string \| null` | Yes |  |
| `agent_label` | `string \| null` | Yes |  |
| `last_used_at` | `string \| null` | Yes |  |
| `last_used_ip_hash` | `string \| null` | Yes |  |
| `expires_at` | `string \| null` | Yes |  |
| `created_by_user_id` | `string \| null` | Yes |  |
| `created_at` | `string` | Yes |  |