EasyXrayEasyXray

API Tokens

Manage scoped Bearer tokens for programmatic auth. Tokens grant admin, monitor, or node-sync access, may expire, and are stored as SHA-256 hashes. The plaintext is returned only once at creation.

List every API token, enabled or not. The token value is never returned — only metadata.

GET
/easyxray/api/v1/setting/apiTokens

Authorization

headerAuthorizationBearer <token>

API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
curl -X GET "https://example.com/easyxray/api/v1/setting/apiTokens"
{  "success": true,  "obj": [    {      "id": 1,      "name": "default",      "enabled": true,      "createdAt": 1736000000    }  ]}

Mint a scoped API token. The server-generated plaintext is returned only once and stored as a hash.

POST
/easyxray/api/v1/setting/apiTokens/create

Authorization

headerAuthorizationBearer <token>

API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Request Body

application/json
  1. body
name*string

Human-readable label, e.g. "central-panel-a".

scope?string

admin (default), monitor, or node-sync.

expiresAt?integer

Future Unix milliseconds, or 0 for no expiry.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?
curl -X POST "https://example.com/easyxray/api/v1/setting/apiTokens/create" \  -H "Content-Type: application/json" \  -d '{    "name": "central-panel-a",    "scope": "node-sync",    "expiresAt": 1798761600000  }'
{  "success": true,  "obj": {    "createdAt": 1736000000,    "enabled": true,    "expiresAt": 0,    "id": 2,    "name": "central-panel-a",    "scope": "admin",    "token": "new-token-string"  }}

Permanently delete a token. Any caller using it stops authenticating immediately.

POST
/easyxray/api/v1/setting/apiTokens/delete/{id}

Authorization

headerAuthorizationBearer <token>

API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Token row ID.

Request Body

application/json
  1. body
expectedScope*string

Stored scope expected by the operator.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
curl -X POST "https://example.com/easyxray/api/v1/setting/apiTokens/delete/0" \  -H "Content-Type: application/json" \  -d '{    "expectedScope": "node-sync"  }'
{  "success": true}

Toggle a token enabled/disabled without deleting it. Disabled tokens are rejected by checkAPIAuth on the next request.

POST
/easyxray/api/v1/setting/apiTokens/setEnabled/{id}

Authorization

headerAuthorizationBearer <token>

API token from Settings → Security → API Token. Send as Authorization: Bearer <token>.

Path Parameters

id*integer

Token row ID.

Request Body

application/json
  1. body
enabled*boolean

New enabled state.

expectedScope*string

Stored scope expected by the operator.

Response Body

Successful response

application/json
  1. response
success?boolean
msg?string
obj?unknown
curl -X POST "https://example.com/easyxray/api/v1/setting/apiTokens/setEnabled/0" \  -H "Content-Type: application/json" \  -d '{    "enabled": false,    "expectedScope": "node-sync"  }'
{  "success": true}