OrgTokenWithSecret

Returned exactly once - on org token creation. The plaintext token field is never re-emitted. Future listings show metadata only via the OrgToken type.

type OrgTokenWithSecret {
  orgTokenId: BigInt!
  orgId: BigInt!
  token: String!
  label: String
  scopes: [String!]!
  appIds: [BigInt!]
  isActive: Boolean!
  expiresAt: DateTime
  createdAt: DateTime!
}

Fields

OrgTokenWithSecret.orgTokenId ● BigInt! non-null scalar

Unique token id (BigInt as string).

OrgTokenWithSecret.orgId ● BigInt! non-null scalar

Organization that owns this token (BigInt as string).

OrgTokenWithSecret.token ● String! non-null scalar

The plaintext token (it starts with cko_), returned exactly once. Save it now: only its hash is stored and it cannot be shown again. Keep it on your organization's server: a request from a browser cannot use it.

OrgTokenWithSecret.label ● String scalar

Optional human-readable label.

OrgTokenWithSecret.scopes ● [String!]! non-null scalar

What the token may do ('players:mint', 'players:manage').

OrgTokenWithSecret.appIds ● [BigInt!] list scalar

The apps the token may sign players in to; null means every app of the organization.

OrgTokenWithSecret.isActive ● Boolean! non-null scalar

Whether the token is active.

OrgTokenWithSecret.expiresAt ● DateTime scalar

Optional expiry timestamp; null means no expiry.

OrgTokenWithSecret.createdAt ● DateTime! non-null scalar

When the token was created.

Returned By

createOrgToken mutation