# Retrieve authentication tokens

Retrieves a list of customer authentication tokens.

Endpoint: GET /authentication-tokens
Version: latest
Security: SecretApiKey, JWT

## Query parameters

- `limit` (integer)
  Limit the number of collection items to be returned. Use `0` to return an empty collection and still receive the count of matching items in `Pagination-Total`.
- `offset` (integer)
  Specifies the starting point within the collection of items to be returned.

## Response 200 fields

- `username` (string, required)
  Username of the customer who is associated with the authentication token.
- `customerId` (string)
  ID of the customer resource.
  Example: cus_0YV7DDSDD1C8DA64KHH2W33CPF
- `token` (string)
  ID of the authentication token.
- `otpRequired` (boolean)
  Specifies if a One-Time Password (OTP) is required to exchange the authentication token.
- `credentialId` (string)
  Unique resource ID.
  Example: 4f6cf35x-2c4y-483z-a0a9-158621f77a21
- `expiredTime` (string | null)
  Date and time when the token expired.
- `_links` (array)
  Related links.
- `_links.href` (string)
  Link URL.
- `_links.rel` (string)
  Type of link.
  Enum: "self"

## Response 401 fields

- `status` (integer)
  HTTP status code.
- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

## Response 403 fields

- `status` (integer)
  HTTP status code.
- `error` (string)
  Message that describes why the request is forbidden. Most responses use a descriptive message, such as `Not allowed to change security settings`. If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`. If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`. If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
- `organizationId` (string)
  Unique organization identifier. An organization is an entity that represents a company. For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
  Example: org_0YVDM8RC7GDADADSBSMW124JA8
- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.