diff --git a/docs/openapi.yaml b/docs/openapi.yaml
new file mode 100644
index 00000000000..fe22bbfba9f
--- /dev/null
+++ b/docs/openapi.yaml
@@ -0,0 +1,456 @@
+openapi: 3.1.0
+info:
+  title: Huly Self-Hosted API
+  version: 0.1.0
+  description: |
+    REST API for Huly self-hosted instances.
+
+    ## Authentication
+
+    All data endpoints require a workspace-scoped JWT in the `Authorization: Bearer <token>` header.
+    Tokens can be minted using the CLI tool (`tools/mint-token/`) or the optional token service (`/_tokens`).
+
+    ## Getting Started
+
+    1. Mint a token using the CLI tool or token service
+    2. Use the token to query the transactor REST API
+    3. The `find-all` endpoint queries documents by class
+    4. The `tx` endpoint submits transactions (create, update, delete)
+
+  license:
+    name: EPL-2.0
+    url: https://www.eclipse.org/legal/epl-2.0/
+
+servers:
+  - url: https://{host}
+    description: Your Huly self-hosted instance
+    variables:
+      host:
+        default: localhost:8083
+
+security:
+  - bearerAuth: []
+
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: |
+        Workspace-scoped JWT. Payload: `{ account: AccountUuid, workspace: WorkspaceUuid, exp: number }`.
+        Signed with `SERVER_SECRET` using HS256.
+
+    serverSecret:
+      type: apiKey
+      in: header
+      name: X-Server-Secret
+      description: SERVER_SECRET value — used for admin-only token service endpoints.
+
+  schemas:
+    TxOperation:
+      type: object
+      description: A Huly transaction object
+      properties:
+        _class:
+          type: string
+          description: Transaction class (e.g. `core:class:TxCreateDoc`)
+          example: 'core:class:TxCreateDoc'
+        objectClass:
+          type: string
+          description: Target document class
+          example: 'tracker:class:Issue'
+        objectSpace:
+          type: string
+          description: Target space
+          example: 'tracker:project:DefaultProject'
+        objectId:
+          type: string
+          description: Document ID (generated or existing)
+        attributes:
+          type: object
+          description: Document attributes to set
+      required:
+        - _class
+
+    FindAllResponse:
+      type: object
+      properties:
+        result:
+          type: array
+          items:
+            type: object
+          description: Array of matching documents
+        total:
+          type: integer
+          description: Total count of matching documents
+
+    TokenRequest:
+      type: object
+      properties:
+        email:
+          type: string
+          format: email
+          description: User email — resolved to account UUID via CockroachDB
+          example: user@example.com
+        workspace:
+          type: string
+          description: Workspace URL slug — resolved to workspace UUID via CockroachDB
+          example: my-workspace
+        expiryDays:
+          type: integer
+          minimum: 1
+          maximum: 365
+          default: 30
+          description: Token lifetime in days
+      required:
+        - email
+        - workspace
+
+    TokenResponse:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Token metadata ID (for listing/revoking)
+        token:
+          type: string
+          description: Signed JWT
+        expiresAt:
+          type: string
+          format: date-time
+          description: Token expiration timestamp
+
+    TokenMetadata:
+      type: object
+      properties:
+        id:
+          type: string
+        email:
+          type: string
+        workspace:
+          type: string
+        createdAt:
+          type: string
+          format: date-time
+        expiresAt:
+          type: string
+          format: date-time
+        revoked:
+          type: boolean
+
+    JsonRpcRequest:
+      type: object
+      properties:
+        method:
+          type: string
+          description: RPC method name
+        params:
+          type: array
+          items: {}
+          description: Method parameters
+      required:
+        - method
+        - params
+
+    JsonRpcResponse:
+      type: object
+      properties:
+        id:
+          type: string
+        result:
+          description: Method-specific result
+
+    Error:
+      type: object
+      properties:
+        error:
+          type: string
+
+paths:
+  # ── Account Service (JSON-RPC) ──────────────────────────────────────
+
+  /_accounts:
+    post:
+      operationId: accountRpc
+      tags: [Auth]
+      summary: Account service JSON-RPC
+      description: |
+        JSON-RPC endpoint for the account service. Key methods:
+
+        - `login(params: [email, password])` → returns account JWT
+        - `selectWorkspace(params: [workspaceUrl, kind, allowAdmin])` → returns workspace JWT + endpoint
+        - `getUserWorkspaces()` → list workspaces for authenticated user
+
+        Note: For API token-based access, you don't need these — mint a token directly.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/JsonRpcRequest'
+            examples:
+              login:
+                summary: Login
+                value:
+                  method: login
+                  params: ['user@example.com', 'password']
+              selectWorkspace:
+                summary: Select workspace
+                value:
+                  method: selectWorkspace
+                  params: ['my-workspace', 'external', false]
+      responses:
+        '200':
+          description: JSON-RPC response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JsonRpcResponse'
+        '400':
+          description: Malformed request
+
+  # ── Transactor REST API ─────────────────────────────────────────────
+
+  /_transactor/api/v1/find-all/{workspace}:
+    get:
+      operationId: findAll
+      tags: [Data]
+      summary: Query documents by class
+      description: |
+        Find all documents matching a class and optional query/options filters.
+        Returns an array of matching documents.
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema:
+            type: string
+          description: Workspace UUID
+          example: 'ws-abc-123'
+        - name: class
+          in: query
+          required: true
+          schema:
+            type: string
+          description: Huly class reference
+          example: 'contact:class:Person'
+        - name: query
+          in: query
+          schema:
+            type: string
+          description: JSON-encoded query filter
+          example: '{"name": "John"}'
+        - name: options
+          in: query
+          schema:
+            type: string
+          description: JSON-encoded options (limit, sort, etc.)
+          example: '{"limit": 10}'
+      responses:
+        '200':
+          description: Matching documents
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/FindAllResponse'
+        '401':
+          description: Invalid or expired token
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+
+  /_transactor/api/v1/tx/{workspace}:
+    post:
+      operationId: submitTx
+      tags: [Data]
+      summary: Submit a transaction
+      description: |
+        Submit a transaction to create, update, or delete documents.
+        The transaction format follows the Huly platform transaction model.
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema:
+            type: string
+          description: Workspace UUID
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TxOperation'
+            examples:
+              createIssue:
+                summary: Create a tracker issue
+                value:
+                  _class: 'core:class:TxCreateDoc'
+                  objectClass: 'tracker:class:Issue'
+                  objectSpace: 'tracker:project:DefaultProject'
+                  attributes:
+                    title: 'Fix login bug'
+                    description: 'Users cannot log in with SSO'
+                    priority: 1
+      responses:
+        '200':
+          description: Transaction result
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          description: Invalid or expired token
+
+  /_transactor/api/v1/load-model/{workspace}:
+    get:
+      operationId: loadModel
+      tags: [Data]
+      summary: Load data model / schema
+      description: |
+        Returns the full data model (class hierarchy, mixins, attributes) for the workspace.
+        Useful for discovering available classes and their fields.
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema:
+            type: string
+          description: Workspace UUID
+      responses:
+        '200':
+          description: Data model
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          description: Invalid or expired token
+
+  /_transactor/api/v1/ping/{workspace}:
+    get:
+      operationId: ping
+      tags: [Data]
+      summary: Health check
+      description: |
+        Verifies the token is valid and the workspace is reachable.
+        Returns a simple status response.
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema:
+            type: string
+          description: Workspace UUID
+      responses:
+        '200':
+          description: Workspace is reachable
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  pong:
+                    type: boolean
+        '401':
+          description: Invalid or expired token
+
+  /_transactor/api/v1/account/{workspace}:
+    get:
+      operationId: getAccountInfo
+      tags: [Data]
+      summary: Get account info
+      description: |
+        Returns information about the authenticated account in the context of the given workspace,
+        including the account UUID and workspace role.
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema:
+            type: string
+          description: Workspace UUID
+      responses:
+        '200':
+          description: Account information
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          description: Invalid or expired token
+
+  # ── Token Service (optional) ────────────────────────────────────────
+
+  /_tokens:
+    post:
+      operationId: mintToken
+      tags: [Tokens]
+      summary: Mint an API token
+      description: |
+        Mint a workspace-scoped JWT. Requires admin auth via `X-Server-Secret` header.
+        Resolves email → account UUID and workspace slug → workspace UUID automatically.
+
+        Only available when `tokenService.enabled: true` in Helm values.
+      security:
+        - serverSecret: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TokenRequest'
+      responses:
+        '200':
+          description: Minted token
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/TokenResponse'
+        '401':
+          description: Invalid server secret
+        '404':
+          description: Email or workspace not found
+
+    get:
+      operationId: listTokens
+      tags: [Tokens]
+      summary: List minted tokens
+      description: Returns metadata for all minted tokens (token values are not stored).
+      security:
+        - serverSecret: []
+      responses:
+        '200':
+          description: Token list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/TokenMetadata'
+        '401':
+          description: Invalid server secret
+
+  /_tokens/{id}:
+    delete:
+      operationId: revokeToken
+      tags: [Tokens]
+      summary: Revoke a token
+      description: |
+        Soft-revoke a token by marking it as revoked in the database.
+        Note: The token will still be valid until it expires, as full revocation
+        requires a denylist check at the transactor level (future enhancement).
+      security:
+        - serverSecret: []
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Token revoked
+        '404':
+          description: Token not found
diff --git a/foundations/core/packages/account-client/src/client.ts b/foundations/core/packages/account-client/src/client.ts
index 1a8e6ea4308..00cf1453522 100644
--- a/foundations/core/packages/account-client/src/client.ts
+++ b/foundations/core/packages/account-client/src/client.ts
@@ -35,6 +35,8 @@ import {
 import platform, { PlatformError, Severity, Status } from '@hcengineering/platform'
 import type {
   AccountAggregatedInfo,
+  ApiTokenInfo,
+  ApiTokenResult,
   Integration,
   IntegrationKey,
   IntegrationSecret,
@@ -255,6 +257,17 @@ export interface AccountClient {
   getWorkspaceUsersWithPermission: (params: { permission: string }) => Promise<AccountUuid[]>
 
   verify2fa: (code: string) => Promise<LoginInfo>
+  createApiToken: (
+    name: string,
+    workspaceUuid: WorkspaceUuid,
+    expiryDays: number,
+    scopes?: string[]
+  ) => Promise<ApiTokenResult>
+  listApiTokens: () => Promise<ApiTokenInfo[]>
+  revokeApiToken: (tokenId: string) => Promise<void>
+  listWorkspaceApiTokens: (workspaceUuid: WorkspaceUuid) => Promise<ApiTokenInfo[]>
+  revokeWorkspaceApiToken: (tokenId: string, workspaceUuid: WorkspaceUuid) => Promise<void>
+  checkApiTokenRevoked: (apiTokenId: string) => Promise<boolean>
 
   setCookie: () => Promise<void>
   deleteCookie: () => Promise<void>
@@ -1224,6 +1237,65 @@ class AccountClientImpl implements AccountClient {
     await this.rpc(request)
   }
 
+  async createApiToken (
+    name: string,
+    workspaceUuid: WorkspaceUuid,
+    expiryDays: number,
+    scopes?: string[]
+  ): Promise<ApiTokenResult> {
+    const request = {
+      method: 'createApiToken' as const,
+      params: { name, workspaceUuid, expiryDays, scopes }
+    }
+
+    return await this.rpc(request)
+  }
+
+  async listApiTokens (): Promise<ApiTokenInfo[]> {
+    const request = {
+      method: 'listApiTokens' as const,
+      params: {}
+    }
+
+    return await this.rpc(request)
+  }
+
+  async revokeApiToken (tokenId: string): Promise<void> {
+    const request = {
+      method: 'revokeApiToken' as const,
+      params: { tokenId }
+    }
+
+    await this.rpc(request)
+  }
+
+  async listWorkspaceApiTokens (workspaceUuid: WorkspaceUuid): Promise<ApiTokenInfo[]> {
+    const request = {
+      method: 'listWorkspaceApiTokens' as const,
+      params: { workspaceUuid }
+    }
+
+    return await this.rpc(request)
+  }
+
+  async revokeWorkspaceApiToken (tokenId: string, workspaceUuid: WorkspaceUuid): Promise<void> {
+    const request = {
+      method: 'revokeWorkspaceApiToken' as const,
+      params: { tokenId, workspaceUuid }
+    }
+
+    await this.rpc(request)
+  }
+
+  async checkApiTokenRevoked (apiTokenId: string): Promise<boolean> {
+    const request = {
+      method: 'checkApiTokenRevoked' as const,
+      params: { apiTokenId }
+    }
+
+    return await this.rpc(request)
+  }
+
   async setCookie (): Promise<void> {
     const url = concatLink(this.url, '/cookie')
     const response = await fetch(url, { ...this.request, method: 'PUT' })
diff --git a/foundations/core/packages/account-client/src/types.ts b/foundations/core/packages/account-client/src/types.ts
index c9f791f3c21..82dfae11c05 100644
--- a/foundations/core/packages/account-client/src/types.ts
+++ b/foundations/core/packages/account-client/src/types.ts
@@ -112,6 +112,23 @@ export interface MailboxInfo {
   appPasswords: string[]
 }
 
+export interface ApiTokenInfo {
+  id: string
+  name: string
+  workspaceUuid: WorkspaceUuid
+  workspaceName: string
+  createdOn: number
+  expiresOn: number
+  revoked: boolean
+  scopes?: string[]
+}
+
+export interface ApiTokenResult {
+  id: string
+  token: string
+  expiresOn: number
+}
+
 export interface MailboxSecret {
   mailbox: string
   app?: string
diff --git a/models/setting/src/index.ts b/models/setting/src/index.ts
index 66ec8a9be99..528dbb67732 100644
--- a/models/setting/src/index.ts
+++ b/models/setting/src/index.ts
@@ -440,6 +440,19 @@ export function createModel (builder: Builder): void {
     setting.ids.OfficeSettings
   )
 
+  builder.createDoc(
+    setting.class.WorkspaceSettingCategory,
+    core.space.Model,
+    {
+      name: 'apiTokens',
+      label: setting.string.ApiTokens,
+      icon: setting.icon.ApiToken,
+      component: setting.component.ApiTokens,
+      order: 1050,
+      role: AccountRole.Owner
+    },
+    setting.ids.ApiTokens
+  )
   // Currently remove Support item from settings
   // builder.createDoc(
   //   setting.class.SettingsCategory,
diff --git a/plugins/setting-assets/assets/icons.svg b/plugins/setting-assets/assets/icons.svg
index 22429b72110..f96d4a989c4 100644
--- a/plugins/setting-assets/assets/icons.svg
+++ b/plugins/setting-assets/assets/icons.svg
@@ -98,4 +98,7 @@
     <path d="M12.0789 2.25C7.2854 2.25 3.34478 5.913 2.96055 10.5833H2.00002C1.69614 10.5833 1.42229 10.7667 1.30655 11.0477C1.19081 11.3287 1.25606 11.6517 1.47178 11.8657L3.15159 13.5324C3.444 13.8225 3.91567 13.8225 4.20808 13.5324L5.88789 11.8657C6.10361 11.6517 6.16886 11.3287 6.05312 11.0477C5.93738 10.7667 5.66353 10.5833 5.35965 10.5833H4.4668C4.84652 6.75167 8.10479 3.75 12.0789 3.75C14.8484 3.75 17.2727 5.20845 18.6156 7.39279C18.8325 7.74565 19.2944 7.85585 19.6473 7.63892C20.0002 7.42199 20.1104 6.96007 19.8934 6.60721C18.2871 3.99427 15.3873 2.25 12.0789 2.25Z"/>
     <path d="M20.8412 10.4666C20.5491 10.1778 20.0789 10.1778 19.7868 10.4666L18.1005 12.1333C17.8842 12.3471 17.8185 12.6703 17.934 12.9517C18.0496 13.233 18.3236 13.4167 18.6278 13.4167H19.5269C19.1456 17.2462 15.876 20.25 11.8828 20.25C9.10034 20.25 6.66595 18.7903 5.31804 16.6061C5.10051 16.2536 4.63841 16.1442 4.28591 16.3618C3.93342 16.5793 3.82401 17.0414 4.04154 17.3939C5.65416 20.007 8.56414 21.75 11.8828 21.75C16.6907 21.75 20.6476 18.0892 21.0332 13.4167H22.0002C22.3044 13.4167 22.5784 13.233 22.694 12.9517C22.8096 12.6703 22.7438 12.3471 22.5275 12.1333L20.8412 10.4666Z"/>
   </symbol>
+  <symbol id="apiToken" viewBox="0 0 16 16">
+    <path fill="currentColor" d="M8.5 1a3.5 3.5 0 0 0-2.83 5.56L2 10.22V14h3v-2h2v-2h1.28l.39-.39A3.5 3.5 0 1 0 8.5 1Zm1.25 4a1.25 1.25 0 1 1 0-2.5 1.25 1.25 0 0 1 0 2.5Z"/>
+  </symbol>
 </svg>
diff --git a/plugins/setting-assets/lang/cs.json b/plugins/setting-assets/lang/cs.json
index 14aba538019..faa788292fb 100644
--- a/plugins/setting-assets/lang/cs.json
+++ b/plugins/setting-assets/lang/cs.json
@@ -234,6 +234,47 @@
     "TwoFactorAuthEnabled": "Dvoufaktorové ověřování je povoleno",
     "TwoFactorAuthDisabled": "Dvoufaktorové ověřování je zakázáno",
     "ShowQRCode": "Zobrazit QR kód",
-    "EnterVerificationCode": "Zadejte ověřovací kód"
+    "EnterVerificationCode": "Zadejte ověřovací kód",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "Login": "Login",
+    "Primary": "Primary",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/de.json b/plugins/setting-assets/lang/de.json
index d44044976dc..27ddce2187a 100644
--- a/plugins/setting-assets/lang/de.json
+++ b/plugins/setting-assets/lang/de.json
@@ -236,6 +236,46 @@
     "TwoFactorAuthEnabled": "Zweistufige Authentifizierung ist aktiviert",
     "TwoFactorAuthDisabled": "Zweistufige Authentifizierung ist deaktiviert",
     "ShowQRCode": "QR-Code anzeigen",
-    "EnterVerificationCode": "Verifizierungscode eingeben"
+    "EnterVerificationCode": "Verifizierungscode eingeben",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "BetaWarning": "Modules labeled as beta are available for experimental purposes and may not be fully functional. We do not recommend relying on beta features for critical work at this time.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/en.json b/plugins/setting-assets/lang/en.json
index f867cf36b45..0007125f8b4 100644
--- a/plugins/setting-assets/lang/en.json
+++ b/plugins/setting-assets/lang/en.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "Two-factor authentication is enabled",
     "TwoFactorAuthDisabled": "Two-factor authentication is disabled",
     "ShowQRCode": "Show QR code",
-    "EnterVerificationCode": "Enter verification code"
+    "EnterVerificationCode": "Enter verification code",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create token",
+    "ApiTokenName": "Token name",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointAccount": "Get account info",
+    "ApiBaseUrl": "Base URL",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL."
   }
 }
diff --git a/plugins/setting-assets/lang/es.json b/plugins/setting-assets/lang/es.json
index a63b17d0eb5..8ac93fe22b3 100644
--- a/plugins/setting-assets/lang/es.json
+++ b/plugins/setting-assets/lang/es.json
@@ -227,6 +227,54 @@
     "TwoFactorAuthEnabled": "La autenticación de dos factores está habilitada",
     "TwoFactorAuthDisabled": "La autenticación de dos factores está deshabilitada",
     "ShowQRCode": "Mostrar código QR",
-    "EnterVerificationCode": "Introducir código de verificación"
+    "EnterVerificationCode": "Introducir código de verificación",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CountSpaces": "{count, plural, =0 {No spaces} =1 {# space} other {# spaces}}",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Description": "Description",
+    "Expires": "Expires",
+    "General": "General",
+    "NewSpaceType": "New space type",
+    "Permissions": "Permissions",
+    "RoleName": "Role name",
+    "Roles": "Roles",
+    "SpaceTypeTitle": "Space type title",
+    "SpaceTypes": "Space types",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/fr.json b/plugins/setting-assets/lang/fr.json
index 8305bd751e6..39371d81281 100644
--- a/plugins/setting-assets/lang/fr.json
+++ b/plugins/setting-assets/lang/fr.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "L'authentification à deux facteurs est activée",
     "TwoFactorAuthDisabled": "L'authentification à deux facteurs est désactivée",
     "ShowQRCode": "Afficher le code QR",
-    "EnterVerificationCode": "Entrer le code de vérification"
+    "EnterVerificationCode": "Entrer le code de vérification",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/it.json b/plugins/setting-assets/lang/it.json
index a2f4e354c57..6a6a6bf9b1e 100644
--- a/plugins/setting-assets/lang/it.json
+++ b/plugins/setting-assets/lang/it.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "L'autenticazione a due fattori è abilitata",
     "TwoFactorAuthDisabled": "L'autenticazione a due fattori è disabilitata",
     "ShowQRCode": "Mostra codice QR",
-    "EnterVerificationCode": "Inserisci codice di verifica"
+    "EnterVerificationCode": "Inserisci codice di verifica",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/ja.json b/plugins/setting-assets/lang/ja.json
index 2abcffd54e4..28c15562bd0 100644
--- a/plugins/setting-assets/lang/ja.json
+++ b/plugins/setting-assets/lang/ja.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "二要素認証は有効です",
     "TwoFactorAuthDisabled": "二要素認証は無効です",
     "ShowQRCode": "QRコードを表示",
-    "EnterVerificationCode": "確認コードを入力"
+    "EnterVerificationCode": "確認コードを入力",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/pt-br.json b/plugins/setting-assets/lang/pt-br.json
index 8550ff3875c..47f8f0fdb6c 100644
--- a/plugins/setting-assets/lang/pt-br.json
+++ b/plugins/setting-assets/lang/pt-br.json
@@ -227,6 +227,54 @@
     "TwoFactorAuthEnabled": "Autenticação de dois fatores está ativada",
     "TwoFactorAuthDisabled": "Autenticação de dois fatores está desativada",
     "ShowQRCode": "Mostrar código QR",
-    "EnterVerificationCode": "Inserir código de verificação"
+    "EnterVerificationCode": "Inserir código de verificação",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CountSpaces": "{count, plural, =0 {No spaces} =1 {# space} other {# spaces}}",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Description": "Description",
+    "Expires": "Expires",
+    "General": "General",
+    "NewSpaceType": "New space type",
+    "Permissions": "Permissions",
+    "RoleName": "Role name",
+    "Roles": "Roles",
+    "SpaceTypeTitle": "Space type title",
+    "SpaceTypes": "Space types",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/pt.json b/plugins/setting-assets/lang/pt.json
index cd79967e81f..053b5933022 100644
--- a/plugins/setting-assets/lang/pt.json
+++ b/plugins/setting-assets/lang/pt.json
@@ -227,6 +227,54 @@
     "TwoFactorAuthEnabled": "Autenticação de dois fatores está ativada",
     "TwoFactorAuthDisabled": "Autenticação de dois fatores está desativada",
     "ShowQRCode": "Mostrar código QR",
-    "EnterVerificationCode": "Inserir código de verificação"
+    "EnterVerificationCode": "Inserir código de verificação",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CountSpaces": "{count, plural, =0 {No spaces} =1 {# space} other {# spaces}}",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Description": "Description",
+    "Expires": "Expires",
+    "General": "General",
+    "NewSpaceType": "New space type",
+    "Permissions": "Permissions",
+    "RoleName": "Role name",
+    "Roles": "Roles",
+    "SpaceTypeTitle": "Space type title",
+    "SpaceTypes": "Space types",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/ru.json b/plugins/setting-assets/lang/ru.json
index f1b902d2ca2..226f3a6d382 100644
--- a/plugins/setting-assets/lang/ru.json
+++ b/plugins/setting-assets/lang/ru.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "Двухфакторная аутентификация включена",
     "TwoFactorAuthDisabled": "Двухфакторная аутентификация отключена",
     "ShowQRCode": "Показать QR-код",
-    "EnterVerificationCode": "Введите код подтверждения"
+    "EnterVerificationCode": "Введите код подтверждения",
+    "ApiBaseUrl": "Базовый URL",
+    "ApiEndpointAccount": "Информация об аккаунте",
+    "ApiEndpointFindAll": "Запрос документов по классу",
+    "ApiEndpointFindAllPost": "Запрос с фильтрами (JSON body)",
+    "ApiEndpointLoadModel": "Загрузка модели данных",
+    "ApiEndpointPing": "Проверка состояния",
+    "ApiEndpointTx": "Создание или обновление документов",
+    "ApiTokenCopyWarning": "Скопируйте этот токен сейчас. Вы не сможете увидеть его снова.",
+    "ApiTokenCreated": "Токен создан",
+    "ApiTokenExpiry": "Срок действия",
+    "ApiTokenName": "Название токена",
+    "ApiTokenNoTokens": "API токенов пока нет",
+    "ApiTokenRevoke": "Отозвать токен",
+    "ApiTokenRevokeConfirm": "Вы уверены, что хотите отозвать этот токен? Он больше не будет доступен для API-доступа.",
+    "ApiTokenWorkspace": "Рабочее пространство",
+    "ApiTokenStatusActive": "Активен",
+    "ApiTokenStatusExpiring": "Истекает",
+    "ApiTokenStatusRevoked": "Отозван",
+    "ApiTokenStatusExpired": "Истёк",
+    "ApiTokenExpiry7Days": "7 дней",
+    "ApiTokenExpiry30Days": "30 дней",
+    "ApiTokenExpiry90Days": "90 дней",
+    "ApiTokenExpiry180Days": "180 дней",
+    "ApiTokenExpiry365Days": "365 дней",
+    "ApiTokenLoadError": "Не удалось загрузить API токены",
+    "ApiTokenCreateError": "Не удалось создать токен. Попробуйте ещё раз.",
+    "ApiTokens": "API токены",
+    "ApiUsageDescription": "Используйте API-токен для работы с встроенным REST API для запроса и изменения данных рабочего пространства. Передайте токен как Bearer-токен в заголовке Authorization.",
+    "ApiUsageTitle": "Использование REST API",
+    "ApiWorkspaceId": "Идентификатор вашего рабочего пространства (UUID) включён в токен. Передайте его как :workspaceId в URL.",
+    "CreateApiToken": "Создать токен",
+    "Created": "Создан",
+    "Expires": "Истекает",
+    "TokenStatus": "Статус",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/tr.json b/plugins/setting-assets/lang/tr.json
index a6823e15185..4569c77acb5 100644
--- a/plugins/setting-assets/lang/tr.json
+++ b/plugins/setting-assets/lang/tr.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "İki faktörlü kimlik doğrulama etkin",
     "TwoFactorAuthDisabled": "İki faktörlü kimlik doğrulama devre dışı",
     "ShowQRCode": "QR kodu göster",
-    "EnterVerificationCode": "Doğrulama kodunu gir"
+    "EnterVerificationCode": "Doğrulama kodunu gir",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/lang/zh.json b/plugins/setting-assets/lang/zh.json
index dbb836da062..6a7d9d313c0 100644
--- a/plugins/setting-assets/lang/zh.json
+++ b/plugins/setting-assets/lang/zh.json
@@ -236,6 +236,45 @@
     "TwoFactorAuthEnabled": "双因素认证已启用",
     "TwoFactorAuthDisabled": "双因素认证已禁用",
     "ShowQRCode": "显示QR码",
-    "EnterVerificationCode": "输入验证码"
+    "EnterVerificationCode": "输入验证码",
+    "ApiBaseUrl": "Base URL",
+    "ApiEndpointAccount": "Get account info",
+    "ApiEndpointFindAll": "Query documents by class",
+    "ApiEndpointFindAllPost": "Query with filters (JSON body)",
+    "ApiEndpointLoadModel": "Load the data model",
+    "ApiEndpointPing": "Health check",
+    "ApiEndpointTx": "Create or update documents",
+    "ApiTokenCopyWarning": "Copy this token now. You won't be able to see it again.",
+    "ApiTokenCreated": "Token created",
+    "ApiTokenExpiry": "Expiration",
+    "ApiTokenName": "Token name",
+    "ApiTokenNoTokens": "No API tokens yet",
+    "ApiTokenRevoke": "Revoke token",
+    "ApiTokenRevokeConfirm": "Are you sure you want to revoke this token? It will no longer be usable for API access.",
+    "ApiTokenWorkspace": "Workspace",
+    "ApiTokens": "API Tokens",
+    "ApiUsageDescription": "Use your API token with the built-in REST API to query and modify workspace data. Pass the token as a Bearer token in the Authorization header.",
+    "ApiUsageTitle": "Using the REST API",
+    "ApiWorkspaceId": "Your workspace ID (UUID) is included in the token. Pass it as :workspaceId in the URL.",
+    "CreateApiToken": "Create token",
+    "Created": "Created",
+    "Expires": "Expires",
+    "TokenStatus": "Status",
+    "ApiTokenStatusActive": "Active",
+    "ApiTokenStatusExpiring": "Expiring",
+    "ApiTokenStatusRevoked": "Revoked",
+    "ApiTokenStatusExpired": "Expired",
+    "ApiTokenExpiry7Days": "7 days",
+    "ApiTokenExpiry30Days": "30 days",
+    "ApiTokenExpiry90Days": "90 days",
+    "ApiTokenExpiry180Days": "180 days",
+    "ApiTokenExpiry365Days": "365 days",
+    "ApiTokenLoadError": "Failed to load API tokens",
+    "ApiTokenCreateError": "Failed to create token. Please try again.",
+    "ApiTokenPermissions": "Permissions",
+    "ApiTokenScopePreset": "Permissions",
+    "ApiTokenScopeReadOnly": "Read Only",
+    "ApiTokenScopeReadWrite": "Read & Write",
+    "ApiTokenScopeFullAccess": "Full Access"
   }
 }
diff --git a/plugins/setting-assets/src/index.ts b/plugins/setting-assets/src/index.ts
index 3b19b1f4a17..a91292bd042 100644
--- a/plugins/setting-assets/src/index.ts
+++ b/plugins/setting-assets/src/index.ts
@@ -37,5 +37,6 @@ loadMetadata(setting.icon, {
   Relations: `${icons}#relation`,
   Mailbox: `${icons}#mailbox`,
   OfficeSettings: `${icons}#office`,
-  Reset: `${icons}#reset`
+  Reset: `${icons}#reset`,
+  ApiToken: `${icons}#apiToken`
 })
diff --git a/plugins/setting-resources/src/components/ApiDocsSection.svelte b/plugins/setting-resources/src/components/ApiDocsSection.svelte
new file mode 100644
index 00000000000..34b8c168623
--- /dev/null
+++ b/plugins/setting-resources/src/components/ApiDocsSection.svelte
@@ -0,0 +1,241 @@
+<!--
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+-->
+<script lang="ts">
+  import { fetchMetadataLocalStorage, Label } from '@hcengineering/ui'
+  import { copyTextToClipboard } from '@hcengineering/presentation'
+  import setting from '@hcengineering/setting'
+  import login from '@hcengineering/login'
+
+  let showApiDocs = false
+
+  $: {
+    const endpoint = fetchMetadataLocalStorage(login.metadata.LoginEndpoint) ?? ''
+    baseApiUrl = (endpoint !== '' ? endpoint : window.location.origin) + '/api/v1'
+  }
+  let baseApiUrl: string
+  $: curlExample = `curl -H "Authorization: Bearer YOUR_TOKEN" \\\n  "${baseApiUrl}/find-all/WORKSPACE_ID?class=tracker:class:Project"`
+
+  async function copySnippet (text: string): Promise<void> {
+    await copyTextToClipboard(text)
+  }
+</script>
+
+<div class="api-docs-section">
+  <button
+    class="api-docs-toggle"
+    on:click={() => {
+      showApiDocs = !showApiDocs
+    }}
+  >
+    <span class="api-docs-arrow" class:expanded={showApiDocs}>&#9654;</span>
+    <Label label={setting.string.ApiUsageTitle} />
+  </button>
+  {#if showApiDocs}
+    <div class="api-docs-content">
+      <p class="api-docs-desc"><Label label={setting.string.ApiUsageDescription} /></p>
+
+      <div class="api-docs-block">
+        <span class="api-docs-label"><Label label={setting.string.ApiBaseUrl} /></span>
+        <code
+          class="api-docs-code clickable"
+          role="button"
+          tabindex="0"
+          on:click={() => copySnippet(baseApiUrl)}
+          on:keydown={(e) => {
+            if (e.key === 'Enter' || e.key === ' ') copySnippet(baseApiUrl)
+          }}>{baseApiUrl}</code
+        >
+      </div>
+
+      <p class="api-docs-note"><Label label={setting.string.ApiWorkspaceId} /></p>
+
+      <div class="api-docs-endpoints">
+        <div class="api-docs-endpoint">
+          <div class="api-docs-method get">GET</div>
+          <code>/api/v1/ping/:workspaceId</code>
+          <span class="api-docs-endpoint-desc"><Label label={setting.string.ApiEndpointPing} /></span>
+        </div>
+        <div class="api-docs-endpoint">
+          <div class="api-docs-method get">GET</div>
+          <code>/api/v1/find-all/:workspaceId?class=...</code>
+          <span class="api-docs-endpoint-desc"><Label label={setting.string.ApiEndpointFindAll} /></span>
+        </div>
+        <div class="api-docs-endpoint">
+          <div class="api-docs-method post">POST</div>
+          <code>/api/v1/find-all/:workspaceId</code>
+          <span class="api-docs-endpoint-desc"><Label label={setting.string.ApiEndpointFindAllPost} /></span>
+        </div>
+        <div class="api-docs-endpoint">
+          <div class="api-docs-method post">POST</div>
+          <code>/api/v1/tx/:workspaceId</code>
+          <span class="api-docs-endpoint-desc"><Label label={setting.string.ApiEndpointTx} /></span>
+        </div>
+        <div class="api-docs-endpoint">
+          <div class="api-docs-method get">GET</div>
+          <code>/api/v1/load-model/:workspaceId</code>
+          <span class="api-docs-endpoint-desc"><Label label={setting.string.ApiEndpointLoadModel} /></span>
+        </div>
+        <div class="api-docs-endpoint">
+          <div class="api-docs-method get">GET</div>
+          <code>/api/v1/account/:workspaceId</code>
+          <span class="api-docs-endpoint-desc"><Label label={setting.string.ApiEndpointAccount} /></span>
+        </div>
+      </div>
+
+      <div class="api-docs-example">
+        <span class="api-docs-label">Example</span>
+        <pre
+          class="api-docs-pre clickable"
+          role="button"
+          tabindex="0"
+          on:click={() => copySnippet(curlExample)}
+          on:keydown={(e) => {
+            if (e.key === 'Enter' || e.key === ' ') copySnippet(curlExample)
+          }}>{curlExample}</pre>
+      </div>
+    </div>
+  {/if}
+</div>
+
+<style lang="scss">
+  .api-docs-section {
+    margin-top: 2rem;
+    border-top: 1px solid var(--theme-popup-divider);
+    padding-top: 1rem;
+  }
+  .api-docs-toggle {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    cursor: pointer;
+    font-weight: 500;
+    font-size: 0.875rem;
+    color: var(--theme-content-color);
+    user-select: none;
+    background: none;
+    border: none;
+    padding: 0;
+  }
+  .api-docs-arrow {
+    display: inline-block;
+    font-size: 0.625rem;
+    transition: transform 0.15s ease;
+    color: var(--theme-dark-color);
+  }
+  .api-docs-arrow.expanded {
+    transform: rotate(90deg);
+  }
+  .api-docs-content {
+    margin-top: 1rem;
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+  }
+  .api-docs-desc {
+    font-size: 0.8125rem;
+    color: var(--theme-dark-color);
+    line-height: 1.5;
+  }
+  .api-docs-note {
+    font-size: 0.75rem;
+    color: var(--theme-dark-color);
+    font-style: italic;
+  }
+  .api-docs-block {
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+  }
+  .api-docs-label {
+    font-size: 0.75rem;
+    font-weight: 500;
+    color: var(--theme-dark-color);
+  }
+  .api-docs-code {
+    background: var(--theme-popup-color);
+    border: 1px solid var(--theme-popup-divider);
+    border-radius: 0.375rem;
+    padding: 0.375rem 0.625rem;
+    font-family: var(--mono-font);
+    font-size: 0.75rem;
+    color: var(--theme-content-color);
+    width: fit-content;
+  }
+  .api-docs-endpoints {
+    display: flex;
+    flex-direction: column;
+    gap: 0.375rem;
+  }
+  .api-docs-endpoint {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    font-size: 0.75rem;
+
+    code {
+      font-family: var(--mono-font);
+      color: var(--theme-content-color);
+    }
+  }
+  .api-docs-endpoint-desc {
+    color: var(--theme-dark-color);
+    font-size: 0.6875rem;
+  }
+  .api-docs-method {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    min-width: 2.75rem;
+    padding: 0.125rem 0.375rem;
+    border-radius: 0.25rem;
+    font-size: 0.625rem;
+    font-weight: 600;
+    font-family: var(--mono-font);
+    text-transform: uppercase;
+  }
+  .api-docs-method.get {
+    background-color: var(--tag-accent-PorpoiseColor);
+    color: var(--tag-on-accent-PorpoiseColor);
+  }
+  .api-docs-method.post {
+    background-color: var(--tag-accent-SunshineColor);
+    color: var(--tag-on-accent-SunshineColor);
+  }
+  .api-docs-example {
+    display: flex;
+    flex-direction: column;
+    gap: 0.25rem;
+    margin-top: 0.25rem;
+  }
+  .api-docs-pre {
+    background: var(--theme-popup-color);
+    border: 1px solid var(--theme-popup-divider);
+    border-radius: 0.375rem;
+    padding: 0.625rem 0.75rem;
+    font-family: var(--mono-font);
+    font-size: 0.6875rem;
+    line-height: 1.6;
+    color: var(--theme-content-color);
+    white-space: pre-wrap;
+    word-break: break-all;
+    overflow-x: auto;
+  }
+  .clickable {
+    cursor: pointer;
+    &:hover {
+      border-color: var(--theme-button-hovered);
+    }
+  }
+</style>
diff --git a/plugins/setting-resources/src/components/ApiTokenCreatePopup.svelte b/plugins/setting-resources/src/components/ApiTokenCreatePopup.svelte
new file mode 100644
index 00000000000..f59d5105c4a
--- /dev/null
+++ b/plugins/setting-resources/src/components/ApiTokenCreatePopup.svelte
@@ -0,0 +1,211 @@
+<!--
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+-->
+<script lang="ts">
+  import { type Timestamp, type WorkspaceUuid } from '@hcengineering/core'
+  import presentation, { copyTextToClipboard } from '@hcengineering/presentation'
+  import { type IntlString } from '@hcengineering/platform'
+  import view from '@hcengineering/view'
+  import {
+    DropdownLabelsIntl,
+    type DropdownIntlItem,
+    Label,
+    ListItem,
+    Modal,
+    ModernEditbox,
+    Dropdown,
+    ticker
+  } from '@hcengineering/ui'
+  import setting from '@hcengineering/setting'
+  import { createEventDispatcher, onMount } from 'svelte'
+  import { getAccountClient } from '../utils'
+
+  let name = ''
+  let loading = false
+  let error: IntlString | undefined
+  let wsItems: ListItem[] = []
+  let selectedWs: ListItem | undefined
+  let createdToken: string | undefined
+  let copiedTime: Timestamp | undefined
+  let copied = false
+
+  const scopePresetItems: DropdownIntlItem[] = [
+    { id: 'read-only', label: setting.string.ApiTokenScopeReadOnly },
+    { id: 'read-write', label: setting.string.ApiTokenScopeReadWrite },
+    { id: 'full-access', label: setting.string.ApiTokenScopeFullAccess }
+  ]
+  const scopeScopes: Record<string, string[]> = {
+    'read-only': ['read:*'],
+    'read-write': ['read:*', 'write:*'],
+    'full-access': ['read:*', 'write:*', 'delete:*']
+  }
+  let selectedScopePreset: string = 'read-only'
+
+  function getSelectedScopes (): string[] {
+    return scopeScopes[selectedScopePreset] ?? ['read:*']
+  }
+
+  const expiryItems: DropdownIntlItem[] = [
+    { id: '7', label: setting.string.ApiTokenExpiry7Days },
+    { id: '30', label: setting.string.ApiTokenExpiry30Days },
+    { id: '90', label: setting.string.ApiTokenExpiry90Days },
+    { id: '180', label: setting.string.ApiTokenExpiry180Days },
+    { id: '365', label: setting.string.ApiTokenExpiry365Days }
+  ]
+  let selectedExpiry: string = '30'
+
+  const dispatch = createEventDispatcher()
+
+  $: canSave = !loading && name.trim().length > 0 && selectedWs !== undefined && createdToken === undefined
+
+  $: if (copiedTime !== undefined && copied && $ticker - copiedTime > 1500) {
+    copied = false
+  }
+
+  async function loadWorkspaces (): Promise<void> {
+    const workspaces = await getAccountClient().getUserWorkspaces()
+    wsItems = workspaces.map((w) => ({ _id: w.uuid, label: w.name ?? w.url }))
+    if (wsItems.length > 0) {
+      selectedWs = wsItems[0]
+    }
+  }
+
+  async function create (): Promise<void> {
+    if (selectedWs === undefined) return
+    loading = true
+    error = undefined
+    try {
+      const scopes = getSelectedScopes()
+      const result = await getAccountClient().createApiToken(
+        name.trim(),
+        selectedWs._id as WorkspaceUuid,
+        parseInt(selectedExpiry, 10),
+        scopes
+      )
+      createdToken = result.token
+    } catch (err: any) {
+      console.error('Failed to create API token', err)
+      error = setting.string.ApiTokenCreateError
+    } finally {
+      loading = false
+    }
+  }
+
+  async function copyToken (): Promise<void> {
+    if (createdToken === undefined || !window.isSecureContext) return
+    await copyTextToClipboard(createdToken)
+    copied = true
+    copiedTime = Date.now()
+  }
+
+  onMount(() => {
+    void loadWorkspaces()
+  })
+</script>
+
+<Modal
+  type="type-popup"
+  label={createdToken !== undefined ? setting.string.ApiTokenCreated : setting.string.CreateApiToken}
+  {canSave}
+  okLabel={createdToken !== undefined
+    ? copied
+      ? view.string.Copied
+      : view.string.CopyToClipboard
+    : presentation.string.Create}
+  okAction={createdToken !== undefined ? copyToken : create}
+  onCancel={() => {
+    dispatch('close', createdToken !== undefined)
+  }}
+>
+  {#if createdToken !== undefined}
+    <div class="antiPopup-msg token-reveal">
+      <span class="label"><Label label={setting.string.ApiTokenCopyWarning} /></span>
+      <div
+        class="token-value"
+        role="button"
+        tabindex="0"
+        on:click={copyToken}
+        on:keydown={(e) => {
+          if (e.key === 'Enter' || e.key === ' ') copyToken()
+        }}
+      >
+        {createdToken}
+      </div>
+    </div>
+  {:else}
+    <div class="antiPopup-msg">
+      <ModernEditbox label={setting.string.ApiTokenName} bind:value={name} size="large" kind="ghost" autoFocus />
+    </div>
+    <div class="antiPopup-msg">
+      <span class="label"><Label label={setting.string.ApiTokenWorkspace} /></span>
+      <Dropdown placeholder={setting.string.ApiTokenWorkspace} items={wsItems} bind:selected={selectedWs} />
+    </div>
+    <div class="antiPopup-msg">
+      <span class="label"><Label label={setting.string.ApiTokenScopePreset} /></span>
+      <DropdownLabelsIntl
+        kind="regular"
+        size="medium"
+        items={scopePresetItems}
+        selected={selectedScopePreset}
+        on:selected={(e) => {
+          selectedScopePreset = e.detail
+        }}
+      />
+    </div>
+    <div class="antiPopup-msg">
+      <span class="label"><Label label={setting.string.ApiTokenExpiry} /></span>
+      <DropdownLabelsIntl
+        kind="regular"
+        size="medium"
+        items={expiryItems}
+        selected={selectedExpiry}
+        on:selected={(e) => {
+          selectedExpiry = e.detail
+        }}
+      />
+    </div>
+    {#if error !== undefined}
+      <div class="antiPopup-msg error"><Label label={error} /></div>
+    {/if}
+  {/if}
+</Modal>
+
+<style lang="scss">
+  .token-reveal {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+  }
+  .token-value {
+    background: var(--theme-popup-color);
+    border: 1px solid var(--theme-popup-divider);
+    border-radius: 0.5rem;
+    padding: 0.75rem 1rem;
+    font-family: var(--mono-font);
+    font-size: 0.6875rem;
+    line-height: 1.6;
+    word-break: break-all;
+    cursor: pointer;
+    user-select: all;
+    color: var(--theme-content-color);
+  }
+  .label {
+    font-size: 0.75rem;
+    color: var(--theme-dark-color);
+  }
+  .error {
+    color: var(--theme-error-color);
+    font-size: 0.75rem;
+  }
+</style>
diff --git a/plugins/setting-resources/src/components/ApiTokens.svelte b/plugins/setting-resources/src/components/ApiTokens.svelte
new file mode 100644
index 00000000000..1370ddf69dd
--- /dev/null
+++ b/plugins/setting-resources/src/components/ApiTokens.svelte
@@ -0,0 +1,239 @@
+<!--
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+-->
+<script lang="ts">
+  import { Breadcrumb, Header, IconAdd, Label, Loading, ModernButton, Scroller, showPopup } from '@hcengineering/ui'
+  import { MessageBox } from '@hcengineering/presentation'
+  import { translate } from '@hcengineering/platform'
+  import setting from '@hcengineering/setting'
+  import { type ApiTokenInfo } from '@hcengineering/account-client'
+  import { getAccountClient } from '../utils'
+  import { onMount } from 'svelte'
+  import { themeStore } from '@hcengineering/theme'
+  import ApiTokenCreatePopup from './ApiTokenCreatePopup.svelte'
+  import ApiDocsSection from './ApiDocsSection.svelte'
+
+  let loading = true
+  let loadError = false
+  let tokens: ApiTokenInfo[] = []
+
+  const statusLabelMap = {
+    active: setting.string.ApiTokenStatusActive,
+    expiring: setting.string.ApiTokenStatusExpiring,
+    revoked: setting.string.ApiTokenStatusRevoked,
+    expired: setting.string.ApiTokenStatusExpired
+  } as const
+
+  function loadTokens (): void {
+    loading = true
+    loadError = false
+    getAccountClient()
+      .listApiTokens()
+      .then((res) => {
+        tokens = res.sort((a, b) => b.createdOn - a.createdOn)
+        loading = false
+      })
+      .catch((err) => {
+        console.error('Failed to load API tokens', err)
+        tokens = []
+        loading = false
+        loadError = true
+      })
+  }
+
+  function create (): void {
+    showPopup(ApiTokenCreatePopup, {}, 'top', (res) => {
+      if (res === true) {
+        loadTokens()
+      }
+    })
+  }
+
+  function revoke (token: ApiTokenInfo): void {
+    showPopup(MessageBox, {
+      label: setting.string.ApiTokenRevoke,
+      message: setting.string.ApiTokenRevokeConfirm,
+      dangerous: true,
+      action: async () => {
+        try {
+          await getAccountClient().revokeApiToken(token.id)
+        } catch (err) {
+          console.error('Failed to revoke API token', err)
+        }
+        loadTokens()
+      }
+    })
+  }
+
+  function formatDate (ts: number): string {
+    return new Date(ts).toLocaleDateString($themeStore.language ?? 'en', {
+      month: 'short',
+      day: 'numeric',
+      year: 'numeric'
+    })
+  }
+
+  let scopeLabels = {
+    readOnly: 'Read Only',
+    readWrite: 'Read & Write',
+    fullAccess: 'Full Access'
+  }
+
+  async function resolveScopeLabels (): Promise<void> {
+    const lang = $themeStore.language
+    scopeLabels = {
+      readOnly: await translate(setting.string.ApiTokenScopeReadOnly, {}, lang),
+      readWrite: await translate(setting.string.ApiTokenScopeReadWrite, {}, lang),
+      fullAccess: await translate(setting.string.ApiTokenScopeFullAccess, {}, lang)
+    }
+  }
+
+  function getScopeLabel (token: ApiTokenInfo): string {
+    const scopes = token.scopes
+    if (scopes == null || scopes.length === 0) return scopeLabels.fullAccess
+    const hasRead = scopes.includes('read:*')
+    const hasWrite = scopes.includes('write:*')
+    const hasDelete = scopes.includes('delete:*')
+    if (hasRead && hasWrite && hasDelete && scopes.length === 3) return scopeLabels.fullAccess
+    if (hasRead && hasWrite && scopes.length === 2) return scopeLabels.readWrite
+    if (hasRead && scopes.length === 1) return scopeLabels.readOnly
+    return `${scopes.length} scopes`
+  }
+
+  function getStatus (token: ApiTokenInfo): 'active' | 'expiring' | 'revoked' | 'expired' {
+    if (token.revoked) return 'revoked'
+    const now = Date.now()
+    if (token.expiresOn < now) return 'expired'
+    if (token.expiresOn - now < 7 * 86400000) return 'expiring'
+    return 'active'
+  }
+
+  onMount(() => {
+    loadTokens()
+    void resolveScopeLabels()
+  })
+</script>
+
+<div class="hulyComponent">
+  <Header adaptive={'disabled'}>
+    <Breadcrumb icon={setting.icon.ApiToken} label={setting.string.ApiTokens} size="large" isCurrent />
+    <svelte:fragment slot="actions">
+      <ModernButton
+        kind="primary"
+        icon={IconAdd}
+        label={setting.string.CreateApiToken}
+        disabled={loading}
+        size="small"
+        on:click={create}
+      />
+    </svelte:fragment>
+  </Header>
+  <div class="hulyComponent-content__container columns">
+    <div class="hulyComponent-content__column p-6">
+      {#if loading}
+        <Loading />
+      {:else if loadError}
+        <div class="hulyComponent-content__empty">
+          <Label label={setting.string.ApiTokenLoadError} />
+          <div class="mt-2">
+            <ModernButton label={setting.string.Reconnect} size="small" on:click={loadTokens} />
+          </div>
+        </div>
+      {:else if tokens.length === 0}
+        <div class="hulyComponent-content__empty">
+          <Label label={setting.string.ApiTokenNoTokens} />
+        </div>
+      {:else}
+        <Scroller>
+          <table class="antiGrid">
+            <thead class="scroller-thead">
+              <tr class="scroller-thead__tr">
+                <th><Label label={setting.string.ApiTokenName} /></th>
+                <th><Label label={setting.string.ApiTokenWorkspace} /></th>
+                <th><Label label={setting.string.ApiTokenPermissions} /></th>
+                <th><Label label={setting.string.Created} /></th>
+                <th><Label label={setting.string.Expires} /></th>
+                <th><Label label={setting.string.TokenStatus} /></th>
+                <th></th>
+              </tr>
+            </thead>
+            <tbody>
+              {#each tokens as token}
+                {@const status = getStatus(token)}
+                <tr class="antiGrid-row">
+                  <td class="overflow-label font-medium-14">{token.name}</td>
+                  <td class="overflow-label">{token.workspaceName}</td>
+                  <td><span class="tag-item tag-scope">{getScopeLabel(token)}</span></td>
+                  <td>{formatDate(token.createdOn)}</td>
+                  <td>{token.revoked ? '—' : formatDate(token.expiresOn)}</td>
+                  <td>
+                    <span
+                      class="tag-item"
+                      class:tag-active={status === 'active'}
+                      class:tag-warning={status === 'expiring'}
+                      class:tag-negative={status === 'revoked' || status === 'expired'}
+                    >
+                      <Label label={statusLabelMap[status]} />
+                    </span>
+                  </td>
+                  <td>
+                    {#if !token.revoked}
+                      <ModernButton
+                        kind="negative"
+                        label={setting.string.ApiTokenRevoke}
+                        size="small"
+                        on:click={() => {
+                          revoke(token)
+                        }}
+                      />
+                    {/if}
+                  </td>
+                </tr>
+              {/each}
+            </tbody>
+          </table>
+        </Scroller>
+      {/if}
+
+      <ApiDocsSection />
+    </div>
+  </div>
+</div>
+
+<style lang="scss">
+  .tag-item {
+    display: inline-flex;
+    align-items: center;
+    padding: 0.125rem 0.5rem;
+    border-radius: 1rem;
+    font-size: 0.6875rem;
+    font-weight: 500;
+  }
+  .tag-active {
+    background-color: var(--tag-accent-PorpoiseColor);
+    color: var(--tag-on-accent-PorpoiseColor);
+  }
+  .tag-warning {
+    background-color: var(--tag-accent-SunshineColor);
+    color: var(--tag-on-accent-SunshineColor);
+  }
+  .tag-negative {
+    background-color: var(--tag-accent-FlamingoColor);
+    color: var(--tag-on-accent-FlamingoColor);
+  }
+  .tag-scope {
+    background-color: var(--theme-button-default);
+    color: var(--theme-content-color);
+  }
+</style>
diff --git a/plugins/setting-resources/src/components/General.svelte b/plugins/setting-resources/src/components/General.svelte
index 9f1e4bc367b..f4865baccc2 100644
--- a/plugins/setting-resources/src/components/General.svelte
+++ b/plugins/setting-resources/src/components/General.svelte
@@ -43,7 +43,6 @@
     Toggle
   } from '@hcengineering/ui'
   import settingsRes from '../plugin'
-  import ApiTokenPopup from './ApiTokenPopup.svelte'
   import WorkspacePermissionEditor from './WorkspacePermissionEditor.svelte'
 
   let loading = true
@@ -153,11 +152,6 @@
     await accountClient.updatePasswordAgingRule(passwordAgingRule)
   }
 
-  async function handleGenerateApiToken (): Promise<void> {
-    const { token } = await accountClient.selectWorkspace(workspaceUrl)
-    showPopup(ApiTokenPopup, { token })
-  }
-
   function handleTogglePermissions (): void {
     const newState = !arePermissionsDisabled
     showPopup(MessageBox, {
@@ -318,19 +312,6 @@
             allowGuests={true}
           />
 
-          <div class="flex-col flex-gap-4 mt-6">
-            <div class="title"><Label label={settingsRes.string.ApiAccess} /></div>
-            <div class="w-32">
-              <Button
-                label={settingsRes.string.GenerateApiToken}
-                kind="regular"
-                disabled={workspaceUrl === ''}
-                showTooltip={{ label: settingsRes.string.GenerateApiToken }}
-                on:click={handleGenerateApiToken}
-              />
-            </div>
-          </div>
-
           <div class="flex-col flex-gap-4 mt-6">
             <div class="title"><Label label={settingsRes.string.DangerZone} /></div>
             <div class="w-32">
diff --git a/plugins/setting-resources/src/index.ts b/plugins/setting-resources/src/index.ts
index d11948b02c6..2fc33526718 100644
--- a/plugins/setting-resources/src/index.ts
+++ b/plugins/setting-resources/src/index.ts
@@ -73,6 +73,7 @@ import AddSocialId from './components/socialIds/AddSocialId.svelte'
 import AddEmailSocialId from './components/socialIds/AddEmailSocialId.svelte'
 import Mailboxes from './components/Mailboxes.svelte'
 import GuestPermissionsSettings from './components/GuestPermissionsSettings.svelte'
+import ApiTokens from './components/ApiTokens.svelte'
 import OfficeSettings from './components/OfficeSettings.svelte'
 import BaseIntegrationState from './components/integrations/BaseIntegrationState.svelte'
 import IntegrationStateRow from './components/integrations/IntegrationStateRow.svelte'
@@ -171,7 +172,8 @@ export default async (): Promise<Resources> => ({
     AddEmailSocialId,
     EmployeeRefEditor,
     UserRoleSelect,
-    TwoFactorSettings
+    TwoFactorSettings,
+    ApiTokens
   },
   actionImpl: {
     DeleteMixin
diff --git a/plugins/setting/src/index.ts b/plugins/setting/src/index.ts
index 98c09a0e87d..aa3e3d779b2 100644
--- a/plugins/setting/src/index.ts
+++ b/plugins/setting/src/index.ts
@@ -200,7 +200,8 @@ export default plugin(settingId, {
     OfficeSettings: '' as Ref<Doc>,
     DisablePermissionsConfiguration: '' as Ref<Configuration>,
     Mailboxes: '' as Ref<Doc>,
-    Security: '' as Ref<Doc>
+    Security: '' as Ref<Doc>,
+    ApiTokens: '' as Ref<Doc>
   },
   mixin: {
     Editable: '' as Ref<Mixin<Editable>>,
@@ -246,7 +247,8 @@ export default plugin(settingId, {
     AddEmailSocialId: '' as AnyComponent,
     OfficeSettings: '' as AnyComponent,
     UserRoleSelect: '' as AnyComponent,
-    TwoFactorSettings: '' as AnyComponent
+    TwoFactorSettings: '' as AnyComponent,
+    ApiTokens: '' as AnyComponent
   },
   string: {
     Settings: '' as IntlString,
@@ -353,7 +355,46 @@ export default plugin(settingId, {
     Disconnected: '' as IntlString,
     Available: '' as IntlString,
     NotConnectedIntegration: '' as IntlString,
-    IntegrationIsUnstable: '' as IntlString
+    IntegrationIsUnstable: '' as IntlString,
+    ApiTokenStatusActive: '' as IntlString,
+    ApiTokenStatusExpiring: '' as IntlString,
+    ApiTokenStatusRevoked: '' as IntlString,
+    ApiTokenStatusExpired: '' as IntlString,
+    ApiTokenExpiry7Days: '' as IntlString,
+    ApiTokenExpiry30Days: '' as IntlString,
+    ApiTokenExpiry90Days: '' as IntlString,
+    ApiTokenExpiry180Days: '' as IntlString,
+    ApiTokenExpiry365Days: '' as IntlString,
+    ApiTokenLoadError: '' as IntlString,
+    ApiTokenCreateError: '' as IntlString,
+    ApiTokens: '' as IntlString,
+    CreateApiToken: '' as IntlString,
+    ApiTokenName: '' as IntlString,
+    ApiTokenExpiry: '' as IntlString,
+    ApiTokenCreated: '' as IntlString,
+    ApiTokenRevoke: '' as IntlString,
+    ApiTokenRevokeConfirm: '' as IntlString,
+    ApiTokenCopyWarning: '' as IntlString,
+    ApiTokenNoTokens: '' as IntlString,
+    ApiTokenWorkspace: '' as IntlString,
+    ApiTokenPermissions: '' as IntlString,
+    ApiTokenScopePreset: '' as IntlString,
+    ApiTokenScopeReadOnly: '' as IntlString,
+    ApiTokenScopeReadWrite: '' as IntlString,
+    ApiTokenScopeFullAccess: '' as IntlString,
+    Created: '' as IntlString,
+    Expires: '' as IntlString,
+    TokenStatus: '' as IntlString,
+    ApiUsageTitle: '' as IntlString,
+    ApiUsageDescription: '' as IntlString,
+    ApiEndpointPing: '' as IntlString,
+    ApiEndpointFindAll: '' as IntlString,
+    ApiEndpointFindAllPost: '' as IntlString,
+    ApiEndpointTx: '' as IntlString,
+    ApiEndpointLoadModel: '' as IntlString,
+    ApiEndpointAccount: '' as IntlString,
+    ApiBaseUrl: '' as IntlString,
+    ApiWorkspaceId: '' as IntlString
   },
   icon: {
     AccountSettings: '' as Asset,
@@ -375,7 +416,8 @@ export default plugin(settingId, {
     Relations: '' as Asset,
     Mailbox: '' as Asset,
     OfficeSettings: '' as Asset,
-    Reset: '' as Asset
+    Reset: '' as Asset,
+    ApiToken: '' as Asset
   },
   templateFieldCategory: {
     Integration: '' as Ref<TemplateFieldCategory>
diff --git a/pods/server/src/__tests__/scopes.test.ts b/pods/server/src/__tests__/scopes.test.ts
new file mode 100644
index 00000000000..49249f5b897
--- /dev/null
+++ b/pods/server/src/__tests__/scopes.test.ts
@@ -0,0 +1,61 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import { hasScope, getRequiredScope } from '../rpc'
+
+describe('hasScope', () => {
+  test('returns true when scope is present', () => {
+    expect(hasScope(['read:*', 'write:*'], 'read:*')).toBe(true)
+    expect(hasScope(['read:*', 'write:*'], 'write:*')).toBe(true)
+  })
+
+  test('returns false when scope is missing', () => {
+    expect(hasScope(['read:*'], 'write:*')).toBe(false)
+    expect(hasScope(['read:*'], 'delete:*')).toBe(false)
+  })
+
+  test('returns false for empty scopes array', () => {
+    expect(hasScope([], 'read:*')).toBe(false)
+  })
+
+  test('requires exact match', () => {
+    expect(hasScope(['read:tracker'], 'read:*')).toBe(false)
+    expect(hasScope(['read:*'], 'read:tracker')).toBe(false)
+  })
+})
+
+describe('getRequiredScope', () => {
+  test('ping and generateId require no scope', () => {
+    expect(getRequiredScope('ping')).toBeNull()
+    expect(getRequiredScope('generateId')).toBeNull()
+  })
+
+  test('read methods require read:*', () => {
+    expect(getRequiredScope('findAll')).toBe('read:*')
+    expect(getRequiredScope('searchFulltext')).toBe('read:*')
+    expect(getRequiredScope('loadModel')).toBe('read:*')
+    expect(getRequiredScope('account')).toBe('read:*')
+  })
+
+  test('write methods require write:*', () => {
+    expect(getRequiredScope('tx')).toBe('write:*')
+    expect(getRequiredScope('domainRequest')).toBe('write:*')
+    expect(getRequiredScope('ensurePerson')).toBe('write:*')
+  })
+
+  test('unknown methods default to read:*', () => {
+    expect(getRequiredScope('someUnknownMethod')).toBe('read:*')
+  })
+})
diff --git a/pods/server/src/rpc.ts b/pods/server/src/rpc.ts
index 4c147a4c096..47917e56a63 100644
--- a/pods/server/src/rpc.ts
+++ b/pods/server/src/rpc.ts
@@ -27,7 +27,7 @@ import core, {
 } from '@hcengineering/core'
 import { rpcJSONReplacer, type RateLimitInfo } from '@hcengineering/rpc'
 import type { ClientSessionCtx, ConnectionSocket, Session, SessionManager } from '@hcengineering/server-core'
-import { decodeToken } from '@hcengineering/server-token'
+import { decodeToken, generateToken } from '@hcengineering/server-token'
 
 import { createHash } from 'crypto'
 import { type Express, type Response as ExpressResponse, type Request } from 'express'
@@ -129,6 +129,63 @@ async function sendJson (
   res.end(body)
 }
 
+// ── API Token Revocation Cache ──────────────────────────────────────
+// Per-token cache with 60s TTL. Once a token is confirmed revoked it
+// stays cached permanently (revocation is irreversible). Non-revoked
+// tokens are re-checked every TTL interval.
+const REVOCATION_CACHE_TTL_MS = 60_000
+const revocationCache = new Map<string, { revoked: boolean, checkedAt: number }>()
+
+async function isApiTokenRevoked (apiTokenId: string, accountClient: AccountClient): Promise<boolean> {
+  const now = Date.now()
+  const cached = revocationCache.get(apiTokenId)
+
+  // Permanently cached once revoked
+  if (cached?.revoked === true) return true
+
+  // Re-check if stale or missing
+  if (cached == null || now - cached.checkedAt > REVOCATION_CACHE_TTL_MS) {
+    try {
+      const revoked = await accountClient.checkApiTokenRevoked(apiTokenId)
+      revocationCache.set(apiTokenId, { revoked, checkedAt: now })
+      return revoked
+    } catch {
+      // If we can't reach the account service, use stale cache or allow
+      return cached?.revoked ?? false
+    }
+  }
+
+  return cached.revoked
+}
+
+// ── Token Scope Enforcement ─────────────────────────────────────────
+// Phase 1: coarse scopes only (read:*, write:*, delete:*)
+
+export function hasScope (scopes: string[], required: string): boolean {
+  return scopes.includes(required)
+}
+
+export function getRequiredScope (method: string): string | null {
+  switch (method) {
+    case 'ping':
+    case 'generateId':
+      return null // Always allowed
+    case 'findAll':
+    case 'searchFulltext':
+    case 'loadModel':
+    case 'account':
+      return 'read:*'
+    case 'tx':
+      // write:* checked here; delete:* checked after body parsing in the tx handler
+      return 'write:*'
+    case 'domainRequest':
+    case 'ensurePerson':
+      return 'write:*'
+    default:
+      return 'read:*'
+  }
+}
+
 export function registerRPC (app: Express, sessions: SessionManager, ctx: MeasureContext, accountsUrl: string): void {
   const rpcSessions = new Map<string, RPCClientInfo>()
 
@@ -167,6 +224,31 @@ export function registerRPC (app: Express, sessions: SessionManager, ctx: Measur
         return
       }
 
+      // Reject revoked API tokens (cached check, ~60s TTL)
+      const apiTokenId = decodedToken.extra?.apiTokenId
+      if (apiTokenId !== undefined) {
+        if (
+          await isApiTokenRevoked(
+            apiTokenId,
+            getAccountClient(generateToken(systemAccountUuid, undefined, { service: 'server' }))
+          )
+        ) {
+          sendError(res, 401, { message: 'Token has been revoked' })
+          return
+        }
+      }
+
+      // Enforce token scopes (Phase 1: coarse scopes — read:*, write:*, delete:*)
+      const scopesRaw = decodedToken.extra?.scopes
+      if (scopesRaw !== undefined) {
+        const scopes: string[] = JSON.parse(scopesRaw)
+        const requiredScope = getRequiredScope(method)
+        if (requiredScope !== null && !hasScope(scopes, requiredScope)) {
+          sendError(res, 403, { message: 'Insufficient token scope', required: requiredScope })
+          return
+        }
+      }
+
       let transactorRpc = rpcSessions.get(token)
 
       if (transactorRpc === undefined) {
@@ -267,9 +349,21 @@ export function registerRPC (app: Express, sessions: SessionManager, ctx: Measur
   })
 
   app.post('/api/v1/tx/:workspaceId', (req, res) => {
-    void withSession(req, res, 'tx', async (ctx, session, rateLimit) => {
+    void withSession(req, res, 'tx', async (ctx, session, rateLimit, token) => {
       const tx: any = (await retrieveJson(req)) ?? {}
 
+      // Enforce delete:* scope for remove transactions
+      if (tx._class === core.class.TxRemoveDoc) {
+        const scopesStr = decodeToken(token).extra?.scopes
+        if (scopesStr !== undefined) {
+          const scopes: string[] = JSON.parse(scopesStr)
+          if (!scopes.includes('delete:*')) {
+            sendError(res, 403, { message: 'Insufficient token scope', required: 'delete:*' })
+            return
+          }
+        }
+      }
+
       if (tx._class === core.class.TxDomainEvent) {
         const domainTx = tx as TxDomainEvent
         const { result } = await session.domainRequestRaw(ctx, domainTx.domain, {
diff --git a/pods/server/src/server_http.ts b/pods/server/src/server_http.ts
index c1469b8ae8a..13b35d5ccc5 100644
--- a/pods/server/src/server_http.ts
+++ b/pods/server/src/server_http.ts
@@ -515,11 +515,10 @@ export function startHttpServer (
           }, 1000)
         }
         if ('upgrade' in s) {
-          void cs
-            .send(ctx, { id: -1, result: { state: 'upgrading', stats: (s as any).upgradeInfo } }, false, false)
-            .then(() => {
-              cs.close()
-            })
+          // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+          void cs.send(ctx, { id: -1, result: { state: 'upgrading', stats: (s as any).upgradeInfo } }, false, false).then(() => {
+            cs.close()
+          })
         }
       })
       void webSocketData.session.catch((err) => {
diff --git a/server/account/src/__tests__/apiTokenScopes.test.ts b/server/account/src/__tests__/apiTokenScopes.test.ts
new file mode 100644
index 00000000000..34fa5f5647e
--- /dev/null
+++ b/server/account/src/__tests__/apiTokenScopes.test.ts
@@ -0,0 +1,251 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import { AccountRole, type MeasureContext, type PersonUuid, type WorkspaceUuid } from '@hcengineering/core'
+import { decodeTokenVerbose, generateToken } from '@hcengineering/server-token'
+
+import { type AccountDB } from '../types'
+import { getMethods } from '../operations'
+
+jest.mock('@hcengineering/platform', () => {
+  const actual = jest.requireActual('@hcengineering/platform')
+  return {
+    ...actual,
+    ...actual.default,
+    getMetadata: jest.fn(),
+    translate: jest.fn((id, params) => `${id} << ${JSON.stringify(params)}`)
+  }
+})
+
+jest.mock('@hcengineering/server-token', () => {
+  class TokenError extends Error {
+    constructor (msg: string) {
+      super(msg)
+      this.name = 'TokenError'
+    }
+  }
+  return {
+    decodeTokenVerbose: jest.fn(),
+    decodeToken: jest.fn(),
+    TokenError,
+    generateToken: jest.fn().mockImplementation((account: string, workspace: string, extra: any) => {
+      return `mocked-token-${account}-${workspace}-${JSON.stringify(extra)}`
+    })
+  }
+})
+
+describe('createApiToken scopes', () => {
+  const mockCtx = {
+    error: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn()
+  } as unknown as MeasureContext
+
+  const accountUuid = 'account-uuid' as PersonUuid
+  const workspaceUuid = 'workspace-uuid' as WorkspaceUuid
+
+  const mockDb = {
+    account: { findOne: jest.fn() },
+    workspace: { find: jest.fn().mockResolvedValue([]) },
+    apiToken: {
+      find: jest.fn().mockResolvedValue([]),
+      findOne: jest.fn(),
+      insertOne: jest.fn(),
+      update: jest.fn()
+    },
+    getWorkspaceRole: jest.fn()
+  } as unknown as AccountDB
+
+  const methods = getMethods()
+  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+  const createApiToken = methods.createApiToken!
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    ;(decodeTokenVerbose as jest.Mock).mockReturnValue({
+      account: accountUuid,
+      workspace: workspaceUuid,
+      extra: {}
+    })
+    ;(mockDb.getWorkspaceRole as jest.Mock).mockResolvedValue(AccountRole.Owner)
+    ;(mockDb.apiToken.find as jest.Mock).mockResolvedValue([])
+    ;(mockDb.apiToken.insertOne as jest.Mock).mockResolvedValue(undefined)
+  })
+
+  test('creates token with valid scopes', async () => {
+    const result = await createApiToken(
+      mockCtx,
+      mockDb,
+      null,
+      { id: 1, params: { name: 'test', workspaceUuid, expiryDays: 30, scopes: ['read:*'] } },
+      'test-token'
+    )
+
+    expect(result.result).toBeDefined()
+    expect(result.result.id).toBeDefined()
+    expect(result.result.token).toContain('mocked-token')
+
+    // Verify scopes were passed to generateToken
+    expect(generateToken).toHaveBeenCalledWith(
+      accountUuid,
+      workspaceUuid,
+      expect.objectContaining({ scopes: '["read:*"]' }),
+      undefined,
+      expect.any(Object)
+    )
+
+    // Verify scopes were persisted to DB
+    expect(mockDb.apiToken.insertOne).toHaveBeenCalledWith(expect.objectContaining({ scopes: ['read:*'] }))
+  })
+
+  test('creates token with multiple valid scopes', async () => {
+    const result = await createApiToken(
+      mockCtx,
+      mockDb,
+      null,
+      { id: 1, params: { name: 'test', workspaceUuid, expiryDays: 30, scopes: ['read:*', 'write:*', 'delete:*'] } },
+      'test-token'
+    )
+
+    expect(result.result).toBeDefined()
+    expect(mockDb.apiToken.insertOne).toHaveBeenCalledWith(
+      expect.objectContaining({ scopes: ['read:*', 'write:*', 'delete:*'] })
+    )
+  })
+
+  test('creates token without scopes (full access, backward compat)', async () => {
+    const result = await createApiToken(
+      mockCtx,
+      mockDb,
+      null,
+      { id: 1, params: { name: 'test', workspaceUuid, expiryDays: 30 } },
+      'test-token'
+    )
+
+    expect(result.result).toBeDefined()
+
+    // No scopes in JWT extra
+    expect(generateToken).toHaveBeenCalledWith(
+      accountUuid,
+      workspaceUuid,
+      expect.not.objectContaining({ scopes: expect.anything() }),
+      undefined,
+      expect.any(Object)
+    )
+
+    // scopes field should be undefined in DB insert
+    const insertArg = (mockDb.apiToken.insertOne as jest.Mock).mock.calls[0][0]
+    expect(insertArg.scopes).toBeUndefined()
+  })
+
+  test('rejects invalid scope format', async () => {
+    const result = await createApiToken(
+      mockCtx,
+      mockDb,
+      null,
+      { id: 1, params: { name: 'test', workspaceUuid, expiryDays: 30, scopes: ['invalid'] } },
+      'test-token'
+    )
+
+    expect(result.error).toBeDefined()
+  })
+
+  test('rejects empty scopes array', async () => {
+    const result = await createApiToken(
+      mockCtx,
+      mockDb,
+      null,
+      { id: 1, params: { name: 'test', workspaceUuid, expiryDays: 30, scopes: [] } },
+      'test-token'
+    )
+
+    expect(result.error).toBeDefined()
+  })
+
+  test('rejects domain-scoped scopes in Phase 1', async () => {
+    const result = await createApiToken(
+      mockCtx,
+      mockDb,
+      null,
+      { id: 1, params: { name: 'test', workspaceUuid, expiryDays: 30, scopes: ['read:tracker'] } },
+      'test-token'
+    )
+
+    expect(result.error).toBeDefined()
+  })
+})
+
+describe('listApiTokens includes scopes', () => {
+  const mockCtx = {
+    error: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn()
+  } as unknown as MeasureContext
+
+  const accountUuid = 'account-uuid' as PersonUuid
+  const workspaceUuid = 'workspace-uuid' as WorkspaceUuid
+
+  const mockDb = {
+    workspace: {
+      find: jest.fn().mockResolvedValue([{ uuid: workspaceUuid, name: 'Test' }])
+    },
+    apiToken: {
+      find: jest.fn().mockResolvedValue([
+        {
+          id: 'token-1',
+          accountUuid,
+          name: 'Read Only',
+          workspaceUuid,
+          createdOn: 1000,
+          expiresOn: 2000,
+          revoked: false,
+          scopes: ['read:*']
+        },
+        {
+          id: 'token-2',
+          accountUuid,
+          name: 'Legacy',
+          workspaceUuid,
+          createdOn: 1000,
+          expiresOn: 2000,
+          revoked: false
+          // no scopes field (legacy)
+        }
+      ])
+    }
+  } as unknown as AccountDB
+
+  const methods = getMethods()
+  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+  const listApiTokens = methods.listApiTokens!
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    ;(decodeTokenVerbose as jest.Mock).mockReturnValue({
+      account: accountUuid,
+      workspace: workspaceUuid,
+      extra: {}
+    })
+  })
+
+  test('returns scopes for scoped tokens and undefined for legacy', async () => {
+    const result = await listApiTokens(mockCtx, mockDb, null, { id: 1, params: {} }, 'test-token')
+
+    const tokens = result.result
+    expect(tokens).toHaveLength(2)
+    expect(tokens[0].scopes).toEqual(['read:*'])
+    expect(tokens[1].scopes).toBeUndefined()
+  })
+})
diff --git a/server/account/src/collections/mongo.ts b/server/account/src/collections/mongo.ts
index b4e5e5e7afe..0da5322ff66 100644
--- a/server/account/src/collections/mongo.ts
+++ b/server/account/src/collections/mongo.ts
@@ -58,7 +58,8 @@ import type {
   WorkspaceOperation,
   WorkspaceStatus,
   WorkspaceStatusData,
-  WorkspacePermission
+  WorkspacePermission,
+  ApiToken
 } from '../types'
 import { isShallowEqual } from '../utils'
 
@@ -411,6 +412,7 @@ export class MongoAccountDB implements AccountDB {
 
   workspaceMembers: MongoDbCollection<WorkspaceMember>
   workspacePermission: MongoDbCollection<WorkspacePermission>
+  apiToken: MongoDbCollection<ApiToken, 'id'>
 
   constructor (readonly db: Db) {
     this.migration = new MongoDbCollection<MigrationInfo, 'key'>('migration', db, 'key')
@@ -431,6 +433,7 @@ export class MongoAccountDB implements AccountDB {
 
     this.workspaceMembers = new MongoDbCollection<WorkspaceMember>('workspaceMembers', db)
     this.workspacePermission = new MongoDbCollection<WorkspacePermission>('workspacePermissions', db)
+    this.apiToken = new MongoDbCollection<ApiToken, 'id'>('apiTokens', db, 'id')
   }
 
   async init (): Promise<void> {
@@ -865,6 +868,7 @@ export class MongoAccountDB implements AccountDB {
     }
 
     await this.mailbox.deleteMany({ accountUuid })
+    await this.apiToken.deleteMany({ accountUuid })
 
     await this.socialId.update({ personUuid: accountUuid }, { verifiedOn: undefined })
     await this.workspaceMembers.deleteMany({ accountUuid })
diff --git a/server/account/src/collections/postgres/migrations.ts b/server/account/src/collections/postgres/migrations.ts
index adaef2de9c5..0f4cc8238f7 100644
--- a/server/account/src/collections/postgres/migrations.ts
+++ b/server/account/src/collections/postgres/migrations.ts
@@ -82,7 +82,9 @@ export function getMigrations (ns: string, flavor: DBFlavor): [string, string][]
     getV22Migration(ns, flavor),
     getV23Migration(ns, flavor),
     getV24Migration(ns, flavor),
-    getV25Migration(ns, flavor)
+    getV25Migration(ns, flavor),
+    getV26Migration(ns, flavor),
+    getV27Migration(ns, flavor)
   ]
 }
 
@@ -794,3 +796,44 @@ function getV25Migration (ns: string, flavor: DBFlavor): [string, string] {
     `
   ]
 }
+
+function getV26Migration (ns: string, flavor: DBFlavor): [string, string] {
+  const types = dbTypes[flavor]
+  return [
+    'account_db_v26_add_api_tokens_table',
+    `
+    /* ======= A P I   T O K E N S ======= */
+    CREATE TABLE IF NOT EXISTS ${ns}.api_tokens (
+        id ${types.string} NOT NULL,
+        account_uuid UUID NOT NULL,
+        name ${types.string} NOT NULL,
+        workspace_uuid UUID NOT NULL,
+        created_on ${types.int8} NOT NULL DEFAULT current_epoch_ms(),
+        expires_on ${types.int8} NOT NULL,
+        revoked ${types.bool} NOT NULL DEFAULT false,
+        CONSTRAINT api_tokens_pk PRIMARY KEY (id),
+        CONSTRAINT api_tokens_account_fk FOREIGN KEY (account_uuid) REFERENCES ${ns}.person(uuid),
+        CONSTRAINT api_tokens_workspace_fk FOREIGN KEY (workspace_uuid) REFERENCES ${ns}.workspace(uuid)
+    );
+
+    CREATE INDEX IF NOT EXISTS api_tokens_account_idx
+    ON ${ns}.api_tokens (account_uuid);
+
+    CREATE INDEX IF NOT EXISTS api_tokens_workspace_idx
+    ON ${ns}.api_tokens (workspace_uuid);
+
+    CREATE INDEX IF NOT EXISTS api_tokens_expires_on_idx
+    ON ${ns}.api_tokens (expires_on);
+    `
+  ]
+}
+
+function getV27Migration (ns: string, flavor: DBFlavor): [string, string] {
+  return [
+    'account_db_v27_add_api_token_scopes',
+    `
+    ALTER TABLE ${ns}.api_tokens
+    ADD COLUMN IF NOT EXISTS scopes TEXT[] DEFAULT NULL;
+    `
+  ]
+}
diff --git a/server/account/src/collections/postgres/postgres.ts b/server/account/src/collections/postgres/postgres.ts
index 4ab5aea2b14..84211c544d4 100644
--- a/server/account/src/collections/postgres/postgres.ts
+++ b/server/account/src/collections/postgres/postgres.ts
@@ -50,6 +50,7 @@ import type {
   UserProfile,
   Subscription,
   WorkspacePermission,
+  ApiToken,
   DBFlavor
 } from '../../types'
 
@@ -540,6 +541,7 @@ export class PostgresAccountDB implements AccountDB {
   userProfile: PostgresDbCollection<UserProfile, 'personUuid'>
   subscription: PostgresDbCollection<Subscription, 'id'>
   workspacePermission: PostgresDbCollection<WorkspacePermission>
+  apiToken: PostgresDbCollection<ApiToken, 'id'>
 
   constructor (
     readonly client: Sql,
@@ -609,6 +611,12 @@ export class PostgresAccountDB implements AccountDB {
       timestampFields: ['createdOn'],
       withRetryClient
     })
+    this.apiToken = new PostgresDbCollection<ApiToken, 'id'>('api_tokens', client, {
+      ns,
+      idKey: 'id',
+      timestampFields: ['createdOn', 'expiresOn'],
+      withRetryClient
+    })
   }
 
   getWsMembersTableName (): string {
@@ -1079,6 +1087,7 @@ export class PostgresAccountDB implements AccountDB {
       }
 
       await this.mailbox.deleteMany({ accountUuid }, rTx)
+      await this.apiToken.deleteMany({ accountUuid }, rTx)
 
       await this.socialId.update({ personUuid: accountUuid }, { verifiedOn: undefined }, rTx)
 
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts
index a1869b41c9b..4ef96b28e8d 100644
--- a/server/account/src/operations.ts
+++ b/server/account/src/operations.ts
@@ -35,9 +35,10 @@ import {
   type WorkspaceUuid,
   type IntegrationKind
 } from '@hcengineering/core'
-import platform, { getMetadata, PlatformError, Severity, Status, translate } from '@hcengineering/platform'
+import platform, { PlatformError, Severity, Status, getMetadata, translate } from '@hcengineering/platform'
 import { decodeToken, decodeTokenVerbose, generateToken, type PermissionsGrant } from '@hcengineering/server-token'
 
+import { randomUUID } from 'crypto'
 import { isAdminEmail } from './admin'
 import { accountPlugin } from './plugin'
 import { type AccountServiceMethods, getServiceMethods } from './serviceOperations'
@@ -417,7 +418,7 @@ export async function validateOtp (
       throw new PlatformError(new Status(Severity.ERROR, platform.status.InvalidOtp, {}))
     }
 
-    let callerAccountUuid: AccountUuid | null = null
+    let callerAccountUuid: AccountUuid | undefined
     let callerAccount: Account | null = null
 
     if (action === 'verify') {
@@ -1966,7 +1967,7 @@ export async function getLoginInfoByToken (
   let extra: any
   let grant: PermissionsGrant | undefined
   let sub: AccountUuid | undefined
-  let account: AccountUuid | undefined
+  let account: AccountUuid
   let nbf: number | undefined
   let exp: number | undefined
 
@@ -2566,6 +2567,261 @@ async function deleteMailbox (
   ctx.info('Mailbox deleted', { mailbox, account })
 }
 
+// ── API Token Management ────────────────────────────────────────────
+
+/**
+ * Creates a new API token for the authenticated user.
+ * @param params.name Human-readable token name (1–255 chars)
+ * @param params.workspaceUuid Target workspace — user must have access
+ * @param params.expiryDays Token validity period (1–365 days)
+ * @param params.scopes Optional scopes array. NULL/undefined = full access. e.g. ['read:*', 'write:*']
+ * @returns Token ID, signed JWT, and expiration timestamp (ms)
+ * @throws BadRequest if validation fails
+ * @throws Forbidden if user lacks workspace access
+ */
+async function createApiToken (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string,
+  params: {
+    name: string
+    workspaceUuid: WorkspaceUuid
+    expiryDays: number
+    scopes?: string[]
+  }
+): Promise<{ id: string, token: string, expiresOn: number }> {
+  const { name, workspaceUuid, expiryDays, scopes } = params
+
+  if (
+    name == null ||
+    typeof name !== 'string' ||
+    name.trim() === '' ||
+    name.trim().length > 255 ||
+    workspaceUuid == null
+  ) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+  }
+
+  if (typeof expiryDays !== 'number' || !Number.isFinite(expiryDays)) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+  }
+
+  const days = Math.floor(expiryDays)
+  if (days < 1 || days > 365) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+  }
+
+  const { account, extra } = decodeTokenVerbose(ctx, token)
+
+  // Verify the user has access to this workspace and is at least a User (not a guest)
+  const role = await db.getWorkspaceRole(account, workspaceUuid)
+  if (role == null) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
+  verifyAllowedRole(role, AccountRole.User, extra)
+
+  // Enforce per-account token limit
+  const MAX_TOKENS_PER_ACCOUNT = 100
+  const existingTokens = await db.apiToken.find({ accountUuid: account })
+  if (existingTokens.length >= MAX_TOKENS_PER_ACCOUNT) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+  }
+
+  // Validate scopes if provided
+  const validScopePattern = /^(read|write|delete):\*$/
+  if (scopes !== undefined) {
+    if (!Array.isArray(scopes) || scopes.length === 0) {
+      throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+    }
+    for (const scope of scopes) {
+      if (typeof scope !== 'string' || !validScopePattern.test(scope)) {
+        throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+      }
+    }
+  }
+
+  const now = Date.now()
+  const expiresOn = now + days * 86400000
+  const expSec = Math.floor(expiresOn / 1000)
+
+  const id = randomUUID()
+  const tokenExtra: Record<string, string> = { apiTokenId: id }
+  if (scopes !== undefined) {
+    tokenExtra.scopes = JSON.stringify(scopes)
+  }
+  const apiToken = generateToken(account, workspaceUuid, tokenExtra, undefined, { exp: expSec })
+
+  await db.apiToken.insertOne({
+    id,
+    accountUuid: account,
+    name,
+    workspaceUuid,
+    createdOn: now,
+    expiresOn,
+    revoked: false,
+    scopes
+  })
+
+  ctx.info('API token created', { id, account, workspaceUuid, days, scopes })
+  return { id, token: apiToken, expiresOn }
+}
+
+/**
+ * Lists all API tokens for the authenticated user across all workspaces.
+ * Includes workspace names resolved from workspace UUIDs.
+ */
+async function listApiTokens (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string
+): Promise<
+  Array<{
+    id: string
+    name: string
+    workspaceUuid: WorkspaceUuid
+    workspaceName: string
+    createdOn: number
+    expiresOn: number
+    revoked: boolean
+  }>
+  > {
+  const { account } = decodeTokenVerbose(ctx, token)
+
+  const tokens = await db.apiToken.find({ accountUuid: account })
+  const wsUuids = [...new Set(tokens.map((t) => t.workspaceUuid))]
+  const workspaces = await db.workspace.find({ uuid: { $in: wsUuids } as any })
+  const wsMap = new Map(workspaces.map((w) => [w.uuid, w.name ?? w.url]))
+
+  return tokens.map((t) => ({
+    id: t.id,
+    name: t.name,
+    workspaceUuid: t.workspaceUuid,
+    workspaceName: wsMap.get(t.workspaceUuid) ?? t.workspaceUuid,
+    createdOn: t.createdOn,
+    expiresOn: t.expiresOn,
+    revoked: t.revoked,
+    scopes: t.scopes ?? undefined
+  }))
+}
+
+/**
+ * Soft-revoke: marks the token as revoked in the DB.
+ * The JWT itself remains valid until expiry — full revocation requires
+ * a denylist check at the transactor level (future enhancement).
+ */
+async function revokeApiToken (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string,
+  params: { tokenId: string }
+): Promise<void> {
+  const { account, extra } = decodeTokenVerbose(ctx, token)
+  const { tokenId } = params
+
+  const existing = await db.apiToken.findOne({ id: tokenId, accountUuid: account })
+  if (existing == null) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+  }
+
+  // Verify the user is at least a User (not a guest) in the token's workspace
+  const role = await db.getWorkspaceRole(account, existing.workspaceUuid)
+  verifyAllowedRole(role, AccountRole.User, extra)
+
+  await db.apiToken.update({ id: tokenId }, { revoked: true })
+  ctx.info('API token revoked', { tokenId, account })
+}
+
+/**
+ * Checks if a specific API token has been revoked.
+ * Used by the transactor to enforce revocation at the request level.
+ */
+async function checkApiTokenRevoked (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string,
+  params: { apiTokenId: string }
+): Promise<boolean> {
+  const { apiTokenId } = params
+  const existing = await db.apiToken.findOne({ id: apiTokenId })
+  if (existing == null) {
+    return true // Unknown token treated as revoked
+  }
+  return existing.revoked
+}
+
+/**
+ * Lists all API tokens for a workspace. Requires OWNER role.
+ * Returns tokens from all members, with account UUIDs for attribution.
+ */
+async function listWorkspaceApiTokens (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string,
+  params: { workspaceUuid: WorkspaceUuid }
+): Promise<
+  Array<{
+    id: string
+    name: string
+    accountUuid: PersonUuid
+    workspaceUuid: WorkspaceUuid
+    createdOn: number
+    expiresOn: number
+    revoked: boolean
+  }>
+  > {
+  const { account } = decodeTokenVerbose(ctx, token)
+  const { workspaceUuid } = params
+
+  const role = await db.getWorkspaceRole(account, workspaceUuid)
+  if (role == null || role !== AccountRole.Owner) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
+
+  const tokens = await db.apiToken.find({ workspaceUuid })
+  return tokens.map((t) => ({
+    id: t.id,
+    name: t.name,
+    accountUuid: t.accountUuid,
+    workspaceUuid: t.workspaceUuid,
+    createdOn: t.createdOn,
+    expiresOn: t.expiresOn,
+    revoked: t.revoked,
+    scopes: t.scopes ?? undefined
+  }))
+}
+
+/**
+ * Revoke any token in the workspace. Requires OWNER role.
+ */
+async function revokeWorkspaceApiToken (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string,
+  params: { tokenId: string, workspaceUuid: WorkspaceUuid }
+): Promise<void> {
+  const { account } = decodeTokenVerbose(ctx, token)
+  const { tokenId, workspaceUuid } = params
+
+  const role = await db.getWorkspaceRole(account, workspaceUuid)
+  if (role == null || role !== AccountRole.Owner) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
+
+  const existing = await db.apiToken.findOne({ id: tokenId, workspaceUuid })
+  if (existing == null) {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.BadRequest, {}))
+  }
+
+  await db.apiToken.update({ id: tokenId }, { revoked: true })
+  ctx.info('Workspace API token revoked by owner', { tokenId, account, workspaceUuid })
+}
+
 async function exchangeGuestToken (
   ctx: MeasureContext,
   db: AccountDB,
@@ -2981,7 +3237,7 @@ export async function getSubscriptions (
     targetWorkspace = tokenWorkspace
 
     // Verify user has OWNER or MAINTAINER role
-    const role = await db.getWorkspaceRole(account, targetWorkspace)
+    const role = await db.getWorkspaceRole(account, tokenWorkspace)
     if (role === null) {
       throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
     }
@@ -3264,6 +3520,12 @@ export type AccountMethods =
   | 'hasWorkspacePermission'
   | 'getWorkspacePermissions'
   | 'getWorkspaceUsersWithPermission'
+  | 'createApiToken'
+  | 'listApiTokens'
+  | 'revokeApiToken'
+  | 'listWorkspaceApiTokens'
+  | 'revokeWorkspaceApiToken'
+  | 'checkApiTokenRevoked'
 
 /**
  * @public
@@ -3331,6 +3593,14 @@ export function getMethods (hasSignUp: boolean = true): Partial<Record<AccountMe
     getWorkspacePermissions: wrap(getWorkspacePermissions),
     getWorkspaceUsersWithPermission: wrap(getWorkspaceUsersWithPermission),
 
+    /* API TOKENS */
+    createApiToken: wrap(createApiToken),
+    listApiTokens: wrap(listApiTokens),
+    revokeApiToken: wrap(revokeApiToken),
+    listWorkspaceApiTokens: wrap(listWorkspaceApiTokens),
+    revokeWorkspaceApiToken: wrap(revokeWorkspaceApiToken),
+    checkApiTokenRevoked: wrap(checkApiTokenRevoked),
+
     /* READ OPERATIONS */
     getRegionInfo: wrap(getRegionInfo),
     getUserWorkspaces: wrap(getUserWorkspaces),
diff --git a/server/account/src/types.ts b/server/account/src/types.ts
index d946491c25f..6a070d20b51 100644
--- a/server/account/src/types.ts
+++ b/server/account/src/types.ts
@@ -157,6 +157,35 @@ export interface WorkspaceJoinInfo {
   invite?: WorkspaceInvite | null
 }
 
+/**
+ * Represents an API token record in the database.
+ * Timestamps are in milliseconds since Unix epoch.
+ *
+ * ## Token Scopes
+ *
+ * Phase 1 (coarse): `read:*`, `write:*`, `delete:*`
+ * Phase 2 (planned): domain-scoped like `read:tracker`, `write:chunter`
+ *
+ * NULL/undefined scopes = full access (backward compatible with legacy tokens).
+ * Scopes are embedded in the JWT via `extra.scopes` (JSON-serialized array)
+ * and enforced server-side in `pods/server/src/rpc.ts`.
+ *
+ * @public
+ */
+export interface ApiToken {
+  id: string
+  accountUuid: PersonUuid
+  name: string
+  workspaceUuid: WorkspaceUuid
+  /** Milliseconds since epoch */
+  createdOn: number
+  /** Milliseconds since epoch */
+  expiresOn: number
+  revoked: boolean
+  /** Token scopes. NULL/undefined = full access (legacy). e.g. ['read:*', 'write:tracker'] */
+  scopes?: string[]
+}
+
 export interface Mailbox {
   accountUuid: PersonUuid
   mailbox: string
@@ -324,6 +353,7 @@ export interface AccountDB {
   userProfile: DbCollection<UserProfile>
   subscription: DbCollection<Subscription>
   workspacePermission: DbCollection<WorkspacePermission>
+  apiToken: DbCollection<ApiToken>
 
   init: () => Promise<void>
   createWorkspace: (data: WorkspaceData, status: WorkspaceStatusData) => Promise<WorkspaceUuid>