token

Manage 30-day opaque tokens used for long-lived authentication. These are random strings hashed server-side (not JWTs).

Security Note

Tokens grant access for their lifetime. Store them securely (e.g., environment variables) and revoke them immediately if compromised.

Create a token

Generates a new opaque token. This endpoint requires a session JWT from Clerk.

POST/api/v1/auth/token

Headers

Key	Value	Description
`Authorization`	`Bearer <jwt>`	Required. Your Clerk session JWT.

Errors

Status	Description
401	Missing or invalid JWT
403	Token cannot be created (insufficient permissions)
500	Unexpected server error

Example Request

curl -X POST "https://api.rotationracing.eu/api/v1/auth/token" \
  -H "Authorization: Bearer <clerk-session-jwt>" \

const res = await fetch("https://api.rotationracing.eu/api/v1/auth/token", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${token}`,
  }
});
console.log(data);

import requests

url = "https://api.rotationracing.eu/api/v1/auth/token"
headers = {
    "Authorization": "Bearer <clerk-session-jwt>",
}

response = requests.post(url, headers=headers)

Response

200 OK

{
  "token": "824839c77f7389fadb...",
  "expiresAt": "2025-10-20T12:00:00.000Z"
}

Inspect a token

Retrieve metadata about a specific opaque token.

GET/api/v1/auth/token

Headers

Key	Value	Description
`Authorization`	`Bearer <token>`	Required. The opaque token to inspect.

Errors

Status	Description
401	Missing or invalid token
403	Token cannot be inspected (insufficient permissions)
404	Token not found
500	Unexpected server error

Example Request

curl -X GET "https://api.rotationracing.eu/api/v1/auth/token" \
  -H "Authorization: Bearer <opaque-token>"

const res = await fetch("https://api.rotationracing.eu/api/v1/auth/token", {
  method: "GET",
  headers: { "Authorization": `Bearer ${token}` }
});
console.log(data);

import requests

url = "https://api.rotationracing.eu/api/v1/auth/token"
headers = {"Authorization": "Bearer <opaque-token>"}

response = requests.get(url, headers=headers)

Response

200 OK

{
  "user_id": "user_123",
  "created_at": "2025-09-20T12:00:00.000Z",
  "expires_at": "2025-10-20T12:00:00.000Z"
}

Revoke a token

Permanently invalidates an opaque token.

DELETE/api/v1/auth/token

Headers

Key	Value	Description
`Authorization`	`Bearer <token>`	Required. The opaque token to revoke.

Errors

Status	Description
401	Missing or invalid token
403	Token cannot be revoked (insufficient permissions)
404	Token not found
500	Unexpected server error

Example Request

curl -X DELETE "https://api.rotationracing.eu/api/v1/auth/token" \
  -H "Authorization: Bearer <opaque-token>"

const res = await fetch("https://api.rotationracing.eu/api/v1/auth/token", {
  method: "DELETE",
  headers: { "Authorization": `Bearer ${token}` }
});

import requests

url = "https://api.rotationracing.eu/api/v1/auth/token"
headers = {"Authorization": "Bearer <opaque-token>"}

response = requests.delete(url, headers=headers)

Response

200 OK

{ "ok": true }