Skip to main content
Version: v5.6.1

opschain admin runner-token list

Included from Basic tier

opschain admin runner-token list

Lists runner registration tokens (the v2 RunnerService.ListRegistrationTokens RPC (kind runner)): group, labels, ephemeral flag, uses, expiry and a derived STATUS — so "why won't this token register" reads at a glance, where the registration attempt itself only answers an opaque credential-invalid.

The server never returns a token value: rows are named by the non-redeemable fingerprint recorded at mint time. A lost token value cannot be recovered — mint a new one.

Flags​

FlagMeaning
--server <url>Server base URL. Default: the active context / OPSCHAIN_SERVER.
--auth-token <token>Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login.
--filter <column>[!]=<value>Keep only rows matching the term (repeatable; terms AND). Columns are the printed table headers lowercased (spaces/dashes fold to _); * wildcards match the whole cell case-insensitively, != negates, commas mean any-of. Applied client-side. Grammar: opschain docs cli.

-o json|yaml prints the token rows as a machine document instead of the table.

Output​

FINGERPRINT  GROUP   LABELS  EPHEMERAL  USES  EXPIRES               STATUS
SHA256:tt3…  secure  gpu     -          0/1   2026-10-14T05:00:00Z  active
SHA256:9fk…  default -       ✓          3/∞   2026-10-13T11:00:00Z  expired
  • USES is <redemptions>/<cap>, with ∞ for an uncapped token.
  • STATUS is derived: expired (past its expiry), exhausted (redemptions reached the cap) or active (still redeemable). Only active tokens can enrol runners — and only active tokens block opschain admin runner-group delete.

Exit codes​

0 listed; 1 the request failed (network, HTTP error, rejected token); 2 usage.

Named errors​

  • a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' (exit 2)
  • this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' (exit 2)
  • the server rejected the credential — run 'opschain login' again, or check the admin token (exit 1)

See also​

  • opschain docs cli/admin-runner-token-create — mint a token (the only moment the value is visible).
  • opschain docs cli/admin-runner-group-delete — why still-redeemable tokens matter.