Dashboard › sentry › ApiToken.plaintext_token is one-time-re…

ApiToken.plaintext_token is one-time-read — not available after refresh()

Category: gotcha

Confidence: 1.00

ID: 019d88ff-2b50-76ef-93b8-142b6f87e587

Project ID: 702228c8-56bc-4694-8d5a-174ac2f29105

Cross-project: No

Recalled in other projects: 1

Source session: (none)

Created: 2026-07-30 15:46:04

Updated: 2026-07-30 15:46:04

Cross-Project Recalls

Project	Hits	Last recalled
opencode-lore	1	18h ago

Content

ApiToken.plaintext_token one-time-read: plaintext_token/plaintext_refresh_token set only at create(). After refresh(), plaintext_* NOT repopulated — but token.token and token.refresh_token DB fields DO contain new plaintext (not hashed). hashed_token/hashed_refresh_token are separate fields. Reviewers flagging token.token as hashed is a false positive. Lookup: ApiToken.objects.get(hashed_refresh_token=sha256(value).hexdigest()).