Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Getting a list of refresh tokens

Written by
Updated at January 13, 2026

Note

Once issued in the application, refresh tokens are automatically added to the user profile.

To get a list of refresh tokens for a federated user:

  1. Log in to Yandex Identity Hub using an administrator or organization owner account.
  2. In the left-hand panel, click Users.
  3. Locate the user in the list. Use the filter or search bar at the top of the screen as needed.
  4. Navigate to the Refresh tokens tab.
  5. Optionally, in the Search by client field, enter the name of the OAuth application for which you want to get the list of refresh tokens.
  6. Optionally, in the Search by client ID field, enter the ID of the OAuth application for which you want to get the list of refresh tokens, e.g., yc.oauth.public-sdk for the Yandex Cloud CLI.
  7. Optionally, to change the displayed columns, click in the top-right corner of the list.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

  1. View the description of the command to view a list of refresh tokens:

    yc iam refresh-token list --help

  2. To view the list of refresh tokens, run this command:

    Note

    You can run the yc iam refresh-token list command without specifying any additional filter parameters. In this case, it will return a list of all refresh tokens for the user currently authenticated in the Yandex Cloud CLI.

    yc iam refresh-token list \
  --subject-id <user_ID> \
  --client-id <OAuth_app_ID> \
  --client-instance-info <OAuth_app_version> \
  --protection-level <DPoP_protection_level>

    Where:

    • --subject-id: ID of the federated user to get a list of refresh tokens for. This is an optional setting. If not specified, the system will display a list of refresh tokens for the user currently authenticated in the Yandex Cloud CLI.

      By default, any federated user can view the list of their refresh tokens. To view the lists of other users’ refresh tokens, a user must have one of the following roles for the organization: organization-manager.admin, organization-manager.viewer, or iam.userAccounts.refreshTokenViewer.

    • --client-id: ID of the OAuth application you want to get a list of refresh tokens for, e.g., yc.oauth.public-sdk for the Yandex Cloud CLI. This is an optional setting.

    • --client-instance-info: Version ID of the OAuth application you want to get a list of refresh tokens for, e.g., yc/0.141.0. This is an optional setting.

    • --protection-level: Protection level of the DPoP key for the refresh tokens you want to get the list of. This is an optional setting. The possible values are:

      • INSECURE_KEY_DPOP: The DPoP key is stored in the user’s local file system.
      • SECURE_KEY_DPOP: The DPoP key is stored on a YubiKey.
      • NO_PROTECTION: No DPoP key is used.

    Result:

    Please touch yubikey OK
+--------------------------------------+----------------------+----------------------+----------------------+---------------------+---------------------+---------------------+------------------+
|                  ID                  |      SUBJECT ID      |      CLIENT ID       | CLIENT INSTANCE INFO |     CREATED AT      |     EXPIRES AT      |    LAST USED AT     | PROTECTION LEVEL |
+--------------------------------------+----------------------+----------------------+----------------------+---------------------+---------------------+---------------------+------------------+
| e2675ad9-f51b-48c7-96f4-90ff******** | bfbud0oddqnn******** | yc.oauth.public-sdk  | yc/0.141.0           | 2025-01-28 14:44:00 | 2025-02-28 14:44:00 | 2025-01-28 14:44:00 | SECURE_KEY_DPOP  |
| 8799515e-1c2e-4530-985e-ce43******** | bfbud0oddqnn******** | yc.oauth.public-sdk  | yc/0.141.0           | 2025-01-28 14:41:00 | 2025-02-28 14:41:00 | 2025-01-28 14:42:26 | SECURE_KEY_DPOP  |
| d4c16879-5e64-40b0-9ee3-ed6a******** | bfbud0oddqnn******** | yc.oauth.public-sdk  | yc/0.141.0           | 2024-12-26 08:34:47 | 2025-01-26 08:34:47 | 2024-12-26 08:34:47 | SECURE_KEY_DPOP  |
+--------------------------------------+----------------------+----------------------+----------------------+---------------------+---------------------+---------------------+------------------+

Use the list REST API method for the RefreshToken resource or the RefreshTokenService/List gRPC API call.

You can also view the list of your refresh tokens through the My account portal.

Previous
Revoking an IAM token
Next
Revoking a refresh token