TOKENS(1)

💅 TOKENS(1) — the AFS Command Reference, bestie edition 🎀

okay so we're doing tokens, and also tokens.krb, which is its slightly dusty cousin. Both live in the AFS Command Reference manual, and honestly? They're the "who even am I on this machine" commands. Let's go ✨

---

🌸 NAME 🌸

tokens, tokens.krb — shows you whose tokens you're holding, aka Displays the issuer's tokens 💖

---

🦋 SYNOPSIS 🦋

tokens [-help]

tokens [-h]

tokens.krb [-help]

tokens.krb [-h]

---

✨ DESCRIPTION ✨

So, tokens shows you all the tokens (aka tickets) that are cached on the local machine for whoever's running it — the issuer, that's you 🫶

And like, why do we care? Because AFS server processes are needy: they require their clients to hand over a token as proof that they've authenticated in the server's local cell. No token, no vibes, no access. It's giving "show your ID at the door" 💅

Then there's tokens.krb, which is mostly obsolete (iykyk, it's had its moment 🌈). It does the exact same thing as tokens, except it also shows you the user's Kerberos v4 ticket cache. Retro!

---

🎀 OPTIONS 🎀

• -help — prints the online help for this command. And bestie, listen: all other valid options are ignored when you use this. It's the main character of options. 👑

---

🔥 OUTPUT 🔥

The output lists one token for each cell you're authenticated in. And it tells you all of this:

• The user's AFS UID, if it's available for display.
• The server the token is valid for (normally afs). This includes a cell specification.
• The day and time the token expires.

The Kerberos version of this command, tokens.krb, also reports these deets about the Kerberos ticket-granting ticket: the ticket owner, which Kerberos ticket-granting service issued the ticket (for example, "krbtgt.EXAMPLE.COM"), and the ticket's expiration date.

And at the very end of the output you'll always see the string --End of list--. If you're not authenticated in any cell at all? That line is literally the entire output. Iconic minimalism. 💀

---

🌈 EXAMPLES 🌈

Example numero uno: you're not authenticated in any cell. Look at this little sad empty list:

% tokens
Tokens held by the Cache Manager:

   --End of list--

Second one: you're authenticated in the Example Corporation cell, where you have AFS UID 1000 🥳

% tokens
Tokens held by the Cache Manager:

User's (AFS ID 1000) tokens for afs@example.com [Expires Jan 2 10:00]
   --End of list--

Third: you're authenticated in the Example Corporation cell, the Example Organization cell, and the Example Network cell, with different AFS UIDs in all three. Also — plot twist — the tokens for that last cell are expired 😭

% tokens
Tokens held by the Cache Manager:

User's (AFS ID 1000) tokens for afs@example.com [Expires Jan 3 10:00]
User's (AFS ID 4286) tokens for afs@example.org [Expires Jan 3 1:34]
User's (AFS ID 22) tokens for afs@example.net [>>Expired<]
   --End of list--

Fourth (and this one's the krb girlies 🧚): you use the tokens.krb version after authenticating in the Example Corporation cell with the klog.krb command.

% tokens.krb
Tokens held by the Cache Manager:

User's (AFS ID 1000) tokens for afs@example.com [Expires Jan 31 00:09]
User smiths tokens for krbtgt.EXAMPLE.COM@example.com [Expires Jan 31 00:09]
   --End of list--

---

👑 PRIVILEGE REQUIRED 👑

None. Zero. Nada. You don't need anything special, go off 💜

---

🦋 SEE ALSO 🦋

klog(1), unlog(1) — your lil login/logout besties 🫶

---

💖 COPYRIGHT 💖

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

---

ngl this page was served fresh on 2026-06-25 by OpenAFS, and that's the whole TOKENS(1) vibe check, bestie. drink water, log out when you're done, mwah 💅💖✨