# Publishable tokens and the widget

| Method | Path | Body or result |
|---|---|---|
| GET | `/publishable_tokens` | List active developer-created tokens: prefix, environment, label, `allowed_origins` |
| POST | `/publishable_tokens` | `{ "environment": "live", "label": "website", "allowed_origins": ["https://acme.com"] }`; returns the full token once |
| PATCH | `/publishable_tokens/:prefix` | `{ "allowed_origins": [...] }`; replaces the token's allowed origins |
| DELETE | `/publishable_tokens/:prefix` | Revoke a token |
| GET | `/widget` | Widget configuration, allowed origins, agent availability, tokens, and links to the inbox |

A publishable token is for `live` or `preview`; omission defaults to `live`. A token works only from its own
`allowed_origins`, plus Vatio's own pages and the
[app builders](https://vatio.ai/docs/channels/widget); an origin that is not
`scheme://host[:port]`, `ios-app://BUNDLE_ID` or `android-app://PACKAGE_NAME`
answers 422. The managed token
in the inbox's install snippet is not listed here; its origins are edited in
the tokens section of **Channels → Web widget** in the inbox.

`GET /widget` is read-only. Its `allowed_origins` is every origin some active
token accepts, each token in `publishable_tokens` carries its own list, and
`brand_url` and `tokens_url` link to **Channels → Web widget** in the inbox,
where the widget's look and the tokens' origins are edited.