# 3 November: revoke API tokens one at a time 2026-11-03 · Security > Each sign-in now has its own client token for the API and ZeroLog Code. You can see your tokens in the settings and revoke one of them, or all. The API reference also has its own link in the site header now. Until today an account had a single client token. If it leaked, you could not switch it off yourself; you had to write to us. That gap is closed. *From sign-in to a refused request.* ## What changes Every browser and every paired device now gets its own token from `/api/cli/token`. Ask again from the same place and you get the same token back; a second laptop gets a different one. Under Settings, ZeroLog Code, a new card lists the tokens that still work: the device name, the first characters of the token, when it was created and when it was last used. The full value is never shown again. Each entry has a revoke button, and there is one for all of them. A revoked token is refused from the next request on. A reply that is already streaming runs to its end, so nothing breaks halfway through a sentence. If you revoke a paired device under Devices, the token that device fetched goes with it. Scripts can do the same through three new endpoints, documented in the [API reference](https://zerolog.ch/docs/api): list your tokens, revoke one, revoke all. They need a signed-in session and only ever see your own tokens. ## The old token Accounts that existed before today keep their old account token, so ZeroLog Code and your scripts keep working. It appears in the list as the account token in the older format. Revoke it when you have moved your clients to new tokens; after that, run `zerolog login` again or fetch a new token in the browser. New accounts never get the old kind. ## API in the header The API reference now has its own link in the main navigation of the website, next to Docs. Before, it was only in the footer.