From 41c91f98ae562fb5f01c8a6d2a6a927b42e17379 Mon Sep 17 00:00:00 2001
From: Baptiste Arnaud <contact@baptiste-arnaud.fr>
Date: Fri, 31 Oct 2025 10:13:25 +0100
Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20Refactor=20API=20token=20m?=
 =?UTF-8?q?anagement=20to=20use=20tRPC=20(#2305)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/builder/src/components/TimeSince.tsx     |  7 ++-
 .../user/components/ApiTokensList.tsx         | 36 ++++++-------
 .../user/components/CreateApiTokenDialog.tsx  | 32 ++++++------
 .../user/components/MyAccountForm.tsx         |  2 +-
 .../src/features/user/hooks/useApiTokens.ts   | 23 ++-------
 .../user/queries/createApiTokenQuery.ts       | 14 ------
 .../user/queries/deleteApiTokenQuery.ts       | 14 ------
 .../features/user/server/createApiToken.ts    | 45 +++++++++++++++++
 .../features/user/server/deleteApiToken.ts    | 50 +++++++++++++++++++
 .../src/features/user/server/listApiTokens.ts | 37 ++++++++++++++
 .../src/features/user/server/routers.ts       |  6 +++
 apps/builder/src/features/user/types.ts       |  5 --
 .../pages/api/users/[userId]/api-tokens.ts    | 39 ---------------
 .../users/[userId]/api-tokens/[tokenId].ts    | 20 --------
 14 files changed, 181 insertions(+), 149 deletions(-)
 delete mode 100644 apps/builder/src/features/user/queries/createApiTokenQuery.ts
 delete mode 100644 apps/builder/src/features/user/queries/deleteApiTokenQuery.ts
 create mode 100644 apps/builder/src/features/user/server/createApiToken.ts
 create mode 100644 apps/builder/src/features/user/server/deleteApiToken.ts
 create mode 100644 apps/builder/src/features/user/server/listApiTokens.ts
 delete mode 100644 apps/builder/src/features/user/types.ts
 delete mode 100644 apps/builder/src/pages/api/users/[userId]/api-tokens.ts
 delete mode 100644 apps/builder/src/pages/api/users/[userId]/api-tokens/[tokenId].ts

diff --git a/apps/builder/src/components/TimeSince.tsx b/apps/builder/src/components/TimeSince.tsx
index 4939af456..63a6c12c9 100644
--- a/apps/builder/src/components/TimeSince.tsx
+++ b/apps/builder/src/components/TimeSince.tsx
@@ -1,11 +1,14 @@
 import { T } from "@tolgee/react";
 
 type Props = {
-  date: string;
+  date: string | Date;
 };
 
 export const TimeSince = ({ date }: Props) => {
-  const seconds = Math.floor((Date.now() - new Date(date).getTime()) / 1000);
+  const seconds = Math.floor(
+    (Date.now() - (date instanceof Date ? date : new Date(date)).getTime()) /
+      1000,
+  );
 
   let interval = seconds / 31536000;
 
diff --git a/apps/builder/src/features/user/components/ApiTokensList.tsx b/apps/builder/src/features/user/components/ApiTokensList.tsx
index 230f131a9..af3f3e7d9 100644
--- a/apps/builder/src/features/user/components/ApiTokensList.tsx
+++ b/apps/builder/src/features/user/components/ApiTokensList.tsx
@@ -1,3 +1,4 @@
+import { useMutation } from "@tanstack/react-query";
 import { T, useTranslate } from "@tolgee/react";
 import { byId, isDefined } from "@typebot.io/lib/utils";
 import { Button } from "@typebot.io/ui/components/Button";
@@ -5,22 +6,17 @@ import { Checkbox } from "@typebot.io/ui/components/Checkbox";
 import { Skeleton } from "@typebot.io/ui/components/Skeleton";
 import { Table } from "@typebot.io/ui/components/Table";
 import { useOpenControls } from "@typebot.io/ui/hooks/useOpenControls";
-import type { ClientUser } from "@typebot.io/user/schemas";
 import { useState } from "react";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
 import { TimeSince } from "@/components/TimeSince";
+import { trpc } from "@/lib/queryClient";
 import { toast } from "@/lib/toast";
 import { useApiTokens } from "../hooks/useApiTokens";
-import { deleteApiTokenQuery } from "../queries/deleteApiTokenQuery";
-import type { ApiTokenFromServer } from "../types";
 import { CreateApiTokenDialog } from "./CreateApiTokenDialog";
 
-type Props = { user: ClientUser };
-
-export const ApiTokensList = ({ user }: Props) => {
+export const ApiTokensList = () => {
   const { t } = useTranslate();
-  const { apiTokens, isLoading, mutate } = useApiTokens({
-    userId: user.id,
+  const { apiTokens, isLoading, refetch } = useApiTokens({
     onError: (e) =>
       toast({
         title: "Failed to fetch tokens",
@@ -34,16 +30,17 @@ export const ApiTokensList = ({ user }: Props) => {
   } = useOpenControls();
   const [deletingId, setDeletingId] = useState<string>();
 
-  const refreshListWithNewToken = (token: ApiTokenFromServer) => {
-    if (!apiTokens) return;
-    mutate({ apiTokens: [token, ...apiTokens] });
-  };
+  const { mutate: deleteToken } = useMutation(
+    trpc.user.deleteApiToken.mutationOptions({
+      onSuccess: () => {
+        refetch();
+        setDeletingId(undefined);
+      },
+    }),
+  );
 
-  const deleteToken = async (tokenId?: string) => {
-    if (!apiTokens || !tokenId) return;
-    const { error } = await deleteApiTokenQuery({ userId: user.id, tokenId });
-    if (!error)
-      mutate({ apiTokens: apiTokens.filter((t) => t.id !== tokenId) });
+  const handleTokenCreated = () => {
+    refetch();
   };
 
   return (
@@ -55,9 +52,8 @@ export const ApiTokensList = ({ user }: Props) => {
           {t("account.apiTokens.createButton.label")}
         </Button>
         <CreateApiTokenDialog
-          userId={user.id}
           isOpen={isCreateOpen}
-          onNewToken={refreshListWithNewToken}
+          onNewToken={handleTokenCreated}
           onClose={onCreateClose}
         />
       </div>
@@ -107,7 +103,7 @@ export const ApiTokensList = ({ user }: Props) => {
       </Table.Root>
       <ConfirmDialog
         isOpen={isDefined(deletingId)}
-        onConfirm={() => deleteToken(deletingId)}
+        onConfirm={() => deletingId && deleteToken({ tokenId: deletingId })}
         onClose={() => setDeletingId(undefined)}
         actionType="destructive"
         confirmButtonLabel={t("account.apiTokens.deleteButton.label")}
diff --git a/apps/builder/src/features/user/components/CreateApiTokenDialog.tsx b/apps/builder/src/features/user/components/CreateApiTokenDialog.tsx
index 3610b6000..bb13ddc4c 100644
--- a/apps/builder/src/features/user/components/CreateApiTokenDialog.tsx
+++ b/apps/builder/src/features/user/components/CreateApiTokenDialog.tsx
@@ -1,3 +1,4 @@
+import { useMutation } from "@tanstack/react-query";
 import { useTranslate } from "@tolgee/react";
 import { Button } from "@typebot.io/ui/components/Button";
 import { Dialog } from "@typebot.io/ui/components/Dialog";
@@ -5,20 +6,17 @@ import { Input } from "@typebot.io/ui/components/Input";
 import type { FormEvent } from "react";
 import { useRef, useState } from "react";
 import { CopyInput } from "@/components/inputs/CopyInput";
-import { createApiTokenQuery } from "../queries/createApiTokenQuery";
-import type { ApiTokenFromServer } from "../types";
+import { trpc } from "@/lib/queryClient";
 
 type Props = {
-  userId: string;
   isOpen: boolean;
-  onNewToken: (token: ApiTokenFromServer) => void;
+  onNewToken: () => void;
   onClose: () => void;
 };
 
 const ANIMATION_DURATION = 150;
 
 export const CreateApiTokenDialog = ({
-  userId,
   isOpen,
   onClose,
   onNewToken,
@@ -26,18 +24,20 @@ export const CreateApiTokenDialog = ({
   const inputRef = useRef<HTMLInputElement>(null);
   const { t } = useTranslate();
   const [name, setName] = useState("");
-  const [isSubmitting, setIsSubmitting] = useState(false);
   const [newTokenValue, setNewTokenValue] = useState<string>();
 
-  const createToken = async (e: FormEvent) => {
+  const { mutate: createToken, isPending: isSubmitting } = useMutation(
+    trpc.user.createApiToken.mutationOptions({
+      onSuccess: (data) => {
+        setNewTokenValue(data.apiToken.token);
+        onNewToken();
+      },
+    }),
+  );
+
+  const handleSubmit = (e: FormEvent) => {
     e.preventDefault();
-    setIsSubmitting(true);
-    const { data } = await createApiTokenQuery(userId, { name });
-    if (data?.apiToken) {
-      setNewTokenValue(data.apiToken.token);
-      onNewToken(data.apiToken);
-    }
-    setIsSubmitting(false);
+    createToken({ name });
   };
 
   const handleClose = () => {
@@ -51,7 +51,7 @@ export const CreateApiTokenDialog = ({
   return (
     <Dialog.Root isOpen={isOpen} onClose={handleClose}>
       <Dialog.Popup
-        render={<form onSubmit={createToken} />}
+        render={<form onSubmit={handleSubmit} />}
         initialFocus={inputRef}
       >
         <Dialog.Title>
@@ -87,7 +87,7 @@ export const CreateApiTokenDialog = ({
           {newTokenValue ? null : (
             <Button
               disabled={name.length === 0 || isSubmitting}
-              onClick={createToken}
+              onClick={handleSubmit}
               type="submit"
             >
               {t("account.apiTokens.createModal.createButton.label")}
diff --git a/apps/builder/src/features/user/components/MyAccountForm.tsx b/apps/builder/src/features/user/components/MyAccountForm.tsx
index f6dd62469..6de8cdd3f 100644
--- a/apps/builder/src/features/user/components/MyAccountForm.tsx
+++ b/apps/builder/src/features/user/components/MyAccountForm.tsx
@@ -76,7 +76,7 @@ export const MyAccountForm = () => {
           />
         </div>
       )}
-      {user && <ApiTokensList user={user} />}
+      {user && <ApiTokensList />}
     </div>
   );
 };
diff --git a/apps/builder/src/features/user/hooks/useApiTokens.ts b/apps/builder/src/features/user/hooks/useApiTokens.ts
index 62d9ce505..4a71e1947 100644
--- a/apps/builder/src/features/user/hooks/useApiTokens.ts
+++ b/apps/builder/src/features/user/hooks/useApiTokens.ts
@@ -1,29 +1,16 @@
-import useSWR from "swr";
-import { fetcher } from "@/helpers/fetcher";
-import type { ApiTokenFromServer } from "../types";
-
-type ServerResponse = {
-  apiTokens: ApiTokenFromServer[];
-};
+import { useQuery } from "@tanstack/react-query";
+import { trpc } from "@/lib/queryClient";
 
 export const useApiTokens = ({
-  userId,
   onError,
 }: {
-  userId?: string;
-  onError: (error: Error) => void;
+  onError: (error: { message: string }) => void;
 }) => {
-  const { data, error, mutate } = useSWR<ServerResponse, Error>(
-    userId ? `/api/users/${userId}/api-tokens` : null,
-    fetcher,
-    {
-      dedupingInterval: undefined,
-    },
-  );
+  const { data, error, refetch } = useQuery(trpc.user.listApiTokens.queryOptions());
   if (error) onError(error);
   return {
     apiTokens: data?.apiTokens,
     isLoading: !error && !data,
-    mutate,
+    refetch,
   };
 };
diff --git a/apps/builder/src/features/user/queries/createApiTokenQuery.ts b/apps/builder/src/features/user/queries/createApiTokenQuery.ts
deleted file mode 100644
index 1dddb0732..000000000
--- a/apps/builder/src/features/user/queries/createApiTokenQuery.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { sendRequest } from "@typebot.io/lib/utils";
-import type { ApiTokenFromServer } from "../types";
-
-export const createApiTokenQuery = (
-  userId: string,
-  { name }: { name: string },
-) =>
-  sendRequest<{ apiToken: ApiTokenFromServer & { token: string } }>({
-    url: `/api/users/${userId}/api-tokens`,
-    method: "POST",
-    body: {
-      name,
-    },
-  });
diff --git a/apps/builder/src/features/user/queries/deleteApiTokenQuery.ts b/apps/builder/src/features/user/queries/deleteApiTokenQuery.ts
deleted file mode 100644
index 34148f1be..000000000
--- a/apps/builder/src/features/user/queries/deleteApiTokenQuery.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { sendRequest } from "@typebot.io/lib/utils";
-import type { Prisma } from "@typebot.io/prisma/types";
-
-export const deleteApiTokenQuery = ({
-  userId,
-  tokenId,
-}: {
-  userId: string;
-  tokenId: string;
-}) =>
-  sendRequest<{ apiToken: Prisma.ApiToken }>({
-    url: `/api/users/${userId}/api-tokens/${tokenId}`,
-    method: "DELETE",
-  });
diff --git a/apps/builder/src/features/user/server/createApiToken.ts b/apps/builder/src/features/user/server/createApiToken.ts
new file mode 100644
index 000000000..ec1feaf80
--- /dev/null
+++ b/apps/builder/src/features/user/server/createApiToken.ts
@@ -0,0 +1,45 @@
+import { generateId } from "@typebot.io/lib/utils";
+import prisma from "@typebot.io/prisma";
+import { z } from "@typebot.io/zod";
+import { authenticatedProcedure } from "@/helpers/server/trpc";
+
+const apiTokenWithTokenSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  createdAt: z.date(),
+  token: z.string(),
+});
+
+export const createApiToken = authenticatedProcedure
+  .meta({
+    openapi: {
+      method: "POST",
+      path: "/v1/users/me/api-tokens",
+      tags: ["User"],
+      protect: true,
+    },
+  })
+  .input(
+    z.object({
+      name: z.string(),
+    }),
+  )
+  .output(
+    z.object({
+      apiToken: apiTokenWithTokenSchema,
+    }),
+  )
+  .mutation(async ({ ctx: { user }, input: { name } }) => {
+    const apiToken = await prisma.apiToken.create({
+      data: { name, ownerId: user.id, token: generateId(24) },
+    });
+    return {
+      apiToken: {
+        id: apiToken.id,
+        name: apiToken.name,
+        createdAt: apiToken.createdAt,
+        token: apiToken.token,
+      },
+    };
+  });
+
diff --git a/apps/builder/src/features/user/server/deleteApiToken.ts b/apps/builder/src/features/user/server/deleteApiToken.ts
new file mode 100644
index 000000000..9d170ffda
--- /dev/null
+++ b/apps/builder/src/features/user/server/deleteApiToken.ts
@@ -0,0 +1,50 @@
+import { TRPCError } from "@trpc/server";
+import prisma from "@typebot.io/prisma";
+import { z } from "@typebot.io/zod";
+import { authenticatedProcedure } from "@/helpers/server/trpc";
+
+const apiTokenSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  createdAt: z.date(),
+  token: z.string(),
+  ownerId: z.string(),
+});
+
+export const deleteApiToken = authenticatedProcedure
+  .meta({
+    openapi: {
+      method: "DELETE",
+      path: "/v1/users/me/api-tokens/{tokenId}",
+      tags: ["User"],
+      protect: true,
+    },
+  })
+  .input(
+    z.object({
+      tokenId: z.string(),
+    }),
+  )
+  .output(
+    z.object({
+      apiToken: apiTokenSchema,
+    }),
+  )
+  .mutation(async ({ input: { tokenId }, ctx: { user } }) => {
+    const existingToken = await prisma.apiToken.findUnique({
+      where: { id: tokenId },
+      select: { ownerId: true },
+    });
+
+    if (!existingToken || existingToken.ownerId !== user.id)
+      throw new TRPCError({
+        code: "NOT_FOUND",
+        message: "API token not found",
+      });
+
+    const apiToken = await prisma.apiToken.delete({
+      where: { id: tokenId },
+    });
+    return { apiToken };
+  });
+
diff --git a/apps/builder/src/features/user/server/listApiTokens.ts b/apps/builder/src/features/user/server/listApiTokens.ts
new file mode 100644
index 000000000..a71cd4df8
--- /dev/null
+++ b/apps/builder/src/features/user/server/listApiTokens.ts
@@ -0,0 +1,37 @@
+import prisma from "@typebot.io/prisma";
+import { z } from "@typebot.io/zod";
+import { authenticatedProcedure } from "@/helpers/server/trpc";
+
+const apiTokenSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  createdAt: z.date(),
+});
+
+export const listApiTokens = authenticatedProcedure
+  .meta({
+    openapi: {
+      method: "GET",
+      path: "/v1/users/me/api-tokens",
+      tags: ["User"],
+      protect: true,
+    },
+  })
+  .input(z.void())
+  .output(
+    z.object({
+      apiTokens: z.array(apiTokenSchema),
+    }),
+  )
+  .query(async ({ ctx: { user } }) => {
+    const apiTokens = await prisma.apiToken.findMany({
+      where: { ownerId: user.id },
+      select: {
+        id: true,
+        name: true,
+        createdAt: true,
+      },
+      orderBy: { createdAt: "desc" },
+    });
+    return { apiTokens };
+  });
diff --git a/apps/builder/src/features/user/server/routers.ts b/apps/builder/src/features/user/server/routers.ts
index 0cc3efaac..6926971fe 100644
--- a/apps/builder/src/features/user/server/routers.ts
+++ b/apps/builder/src/features/user/server/routers.ts
@@ -1,9 +1,15 @@
 import { router } from "@/helpers/server/trpc";
 import { acceptTerms } from "./acceptTerms";
+import { createApiToken } from "./createApiToken";
+import { deleteApiToken } from "./deleteApiToken";
+import { listApiTokens } from "./listApiTokens";
 import { updateUser } from "./updateUser";
 
 export const publicUserRouter = router({
   update: updateUser,
+  listApiTokens,
+  createApiToken,
+  deleteApiToken,
 });
 
 export const internalUserRouter = router({
diff --git a/apps/builder/src/features/user/types.ts b/apps/builder/src/features/user/types.ts
deleted file mode 100644
index 9eff39ae5..000000000
--- a/apps/builder/src/features/user/types.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-export type ApiTokenFromServer = {
-  id: string;
-  name: string;
-  createdAt: string;
-};
diff --git a/apps/builder/src/pages/api/users/[userId]/api-tokens.ts b/apps/builder/src/pages/api/users/[userId]/api-tokens.ts
deleted file mode 100644
index c2178d572..000000000
--- a/apps/builder/src/pages/api/users/[userId]/api-tokens.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { methodNotAllowed, notAuthenticated } from "@typebot.io/lib/api/utils";
-import { generateId } from "@typebot.io/lib/utils";
-import prisma from "@typebot.io/prisma";
-import type { NextApiRequest, NextApiResponse } from "next";
-import { getAuthenticatedUser } from "@/features/auth/helpers/getAuthenticatedUser";
-
-const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const user = await getAuthenticatedUser(req, res);
-  if (!user) return notAuthenticated(res);
-  if (req.method === "GET") {
-    const apiTokens = await prisma.apiToken.findMany({
-      where: { ownerId: user.id },
-      select: {
-        id: true,
-        name: true,
-        createdAt: true,
-      },
-      orderBy: { createdAt: "desc" },
-    });
-    return res.send({ apiTokens });
-  }
-  if (req.method === "POST") {
-    const data = typeof req.body === "string" ? JSON.parse(req.body) : req.body;
-    const apiToken = await prisma.apiToken.create({
-      data: { name: data.name, ownerId: user.id, token: generateId(24) },
-    });
-    return res.send({
-      apiToken: {
-        id: apiToken.id,
-        name: apiToken.name,
-        createdAt: apiToken.createdAt,
-        token: apiToken.token,
-      },
-    });
-  }
-  methodNotAllowed(res);
-};
-
-export default handler;
diff --git a/apps/builder/src/pages/api/users/[userId]/api-tokens/[tokenId].ts b/apps/builder/src/pages/api/users/[userId]/api-tokens/[tokenId].ts
deleted file mode 100644
index 59ef0433f..000000000
--- a/apps/builder/src/pages/api/users/[userId]/api-tokens/[tokenId].ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import { methodNotAllowed, notAuthenticated } from "@typebot.io/lib/api/utils";
-import prisma from "@typebot.io/prisma";
-import type { NextApiRequest, NextApiResponse } from "next";
-import { getAuthenticatedUser } from "@/features/auth/helpers/getAuthenticatedUser";
-
-const handler = async (req: NextApiRequest, res: NextApiResponse) => {
-  const user = await getAuthenticatedUser(req, res);
-  if (!user) return notAuthenticated(res);
-
-  if (req.method === "DELETE") {
-    const id = req.query.tokenId as string;
-    const apiToken = await prisma.apiToken.delete({
-      where: { id },
-    });
-    return res.send({ apiToken });
-  }
-  methodNotAllowed(res);
-};
-
-export default handler;