#Publishable tokens
| Command | Purpose |
|---|---|
vatio tokens list / create [--env NAME] [--label NAME] [--origin URL]... / revoke PREFIX | Manage publishable tokens; create defaults to live |
vatio tokens origins PREFIX URL... | Replace a token's allowed origins; with no URL, clear them |
create prints the full token once. list shows prefixes and each token's
allowed origins; the prefix is also what origins and revoke take.
A token works only from its own allowed origins, plus Vatio's own pages and the
app builders (Lovable, Replit, Bolt, v0, Base44); with
none, it works only there. --origin is repeatable. Origins are exact
scheme://host[:port] values, ios-app://BUNDLE_ID for an iOS app, or
android-app://PACKAGE_NAME for an Android app. The
token in the install snippet the inbox shows is managed by Vatio and is not
listed here: edit its origins in the tokens section of Channels → Web widget
in the inbox.
Revoking prevents new chats and conversation lists with that token; chat credentials already issued stay valid until they expire.
vatio env prints an environment's widget snippet with its token. The
widget's look is edited in Channels → Web widget in the inbox; see
Web widget for the fields themselves.
Never use a developer token (vat_…) in a browser. Publishable tokens are the
ones meant for page source, and each token's allowed origins are what scope it.