Get the current token

GET https://app.honeybadger.io/v3/token

Returns the credential making the request and what it can reach. It needs no scope.

project_ids lists the projects the token can reach now; a user token loses a project as soon as its owner does.

Example request

curl "https://app.honeybadger.io/v3/token" \
  -H "Authorization: Bearer $HONEYBADGER_API_TOKEN"

Responses

200 Success

Example payload

{
  "data": {
    "kind": "user",
    "name": "CI deploys",
    "scopes": [
      "faults:read",
      "faults:write"
    ],
    "account_id": "Ab3kL9",
    "project_ids": [
      "string"
    ],
    "expires_at": "2026-01-01T00:00:00Z",
    "last_used_at": "2026-01-01T00:00:00Z"
  },
  "meta": {
    "request_id": "6f1c2b0e-8d4a-4f6e-9b2a-3c5d7e9f1a2b"
  }
}

Response schema10

Field	Type	Description
`data` required	object
`data.kind`	string	`user` and `account` are scoped API tokens. `oauth` is an access token issued to an application acting for a user. Allowed values: `user`, `account`, `oauth`.
`data.name`	string \| null	The token's name. For an OAuth grant, the name the user gave the connection, or the application's name if none.
`data.scopes`	array<string>	Granular permissions. For an OAuth grant these are its legacy `read`/`write` aliases expanded to the API surface as it stood when the grant was consented to.
`data.account_id`	string	ID of the account the credential is bound to.
`data.project_ids`	array<string>	IDs of the projects the credential can reach. Empty for a credential bound to an account with no visible projects; every project in the account when unrestricted.
`data.expires_at`	date-time \| null
`data.last_used_at`	date-time \| null	When the credential was last used before this request. Recorded at most once a minute, so it can lag by up to a minute; null on first use.
`meta`	object
`meta.request_id`	string	Unique identifier for the request, for correlating with support.

Errors

401 Unauthorized

The credential is missing, invalid, expired or revoked (unauthorized), or was sent in a way v3 doesn’t accept (see the examples).

Example payload: unauthorized (Missing, malformed, expired or revoked credential)

{
  "error": {
    "code": "unauthorized",
    "message": "Access denied"
  },
  "meta": {
    "request_id": "abc123"
  }
}

Example payload: unsupported_auth_scheme (Sent as HTTP basic, which v3 does not accept)

{
  "error": {
    "code": "unsupported_auth_scheme",
    "message": "Send the credential as `Authorization: Bearer <token>`; v3 does not accept HTTP basic"
  },
  "meta": {
    "request_id": "abc123"
  }
}

Example payload: credential_in_query (Sent as the `auth_token` query parameter)

{
  "error": {
    "code": "credential_in_query",
    "message": "Credentials must be sent in the Authorization header"
  },
  "meta": {
    "request_id": "abc123"
  }
}

Response schema6

Field	Type	Description
`error` required	object
`error.code` required	string	Machine-readable code. Branch on this, not the message. Allowed values: `unauthorized`, `unsupported_auth_scheme`, `credential_in_query`, `access_denied`, `insufficient_scope`, `requires_user_token`, `project_restricted`, `account_inactive`, `account_parked`, `feature_unavailable`, `not_found`, `validation_error`, `delete_failed`, `limit_reached`, `rate_limit_exceeded`, `concurrent_request`, `streams_provisioning`, `ingestion_key_not_accepted`, `maintenance_mode`, `invalid_parameter`, `forbidden_attributes`, `service_unavailable`, `ambiguous_account`, `fault_merged`.
`error.message` required	string	Human-readable explanation.
`error.details`	array<object> \| object	A list of `{field, message}` on `validation_error` and `invalid_parameter`, and on `feature_unavailable` or `limit_reached` when one field caused the refusal; `{required_scope, token_scopes}` on `insufficient_scope`; `{merged_into, location}` on `fault_merged`. Absent when there's nothing to add.
`meta`	object
`meta.request_id`	string	Unique identifier for the request, for correlating with support.