# Publishable tokens

| Command | Purpose |
|---|---|
| `vatio tokens list` / `create [--env NAME] [--label NAME] [--origin URL]...` / `revoke PREFIX` | Manage publishable tokens; `create` defaults to `live` |
| `vatio tokens origins PREFIX URL...` | Replace a token's allowed origins; with no URL, clear them |

`create` prints the full token once. `list` shows prefixes and each token's
allowed origins; the prefix is also what `origins` and `revoke` take.

A token works only from its own allowed origins, plus Vatio's own pages and the
[app builders](https://vatio.ai/docs/channels/widget) (Lovable, Replit, Bolt, v0, Base44); with
none, it works only there. `--origin` is repeatable. Origins are exact
`scheme://host[:port]` values, `ios-app://BUNDLE_ID` for an iOS app, or
`android-app://PACKAGE_NAME` for an Android app. The
token in the install snippet the inbox shows is managed by Vatio and is not
listed here: edit its origins in the tokens section of **Channels → Web widget**
in the inbox.

Revoking prevents new chats and conversation lists with that token; chat
credentials already issued stay valid until they expire.

`vatio env` prints an environment's widget snippet with its token. The
widget's look is edited in **Channels → Web widget** in the inbox; see
[Web widget](https://vatio.ai/docs/channels/widget) for the fields themselves.

Never use a developer token (`vat_…`) in a browser. Publishable tokens are the
ones meant for page source, and each token's allowed origins are what scope it.