[Bug]: -getApiToken does not work as expected

[brazhenko]

Describe the bug

When I run docker exec 3x-ui /app/x-ui setting -getApiToken I expect to see token as in old version, but see
apiToken: (no token).

How to reproduce the problem

1. Open terminal with 3x-ui running on e.g. on Docker
2. run root@tw:/opt/3x-ui# docker exec 3x-ui /app/x-ui setting -getApiToken

Expected behavior

I expect either to see token or do not have such option at all.

Actual behavior

No response

Relevant logs

Screenshots

No response

3x-ui version

3.3.0

Xray-core version

No response

How did you install 3x-ui?

Docker / Docker Compose

Operating system

Debian 13

Which parts of the panel are affected?

No response

Browser (only if it is a UI bug)

No response

Is the panel behind a reverse proxy or CDN?

None

Before submitting

• I searched existing issues and this bug has not been reported.
• I am running the latest released version of 3x-ui (or have verified the bug still exists on it).
• This bug report is written in English.
• I have redacted any sensitive data (tokens, real domains, client UUIDs).

[github-actions]

This is a confirmed bug introduced by commit 4813a2fe ("hash tokens at rest and show plaintext only once").

Root cause

web/service/api_token.go — toView() intentionally omits the token value when building the list response:

// toView builds the metadata view returned by List. It never carries the
// token value: only a SHA-256 hash is stored, and the plaintext is shown
// exactly once at creation time.
func toView(t *model.ApiToken) *ApiTokenView {
    return &ApiTokenView{
        Id:        t.Id,
        Name:      t.Name,
        Enabled:   t.Enabled,
        CreatedAt: t.CreatedAt,
        // Token field is deliberately left empty
    }
}

main.go — GetApiToken() calls List() and then tries to print tokens[0].Token, which is always "":

tokens, err := apiTokenService.List()
// ...
if len(tokens) > 0 {
    fmt.Println("apiToken:", tokens[0].Token)  // always prints empty string
    return
}

Since tokens are now stored as SHA-256 hashes, the plaintext can never be recovered after creation. The GetApiToken function was not updated to account for this.

The only case where the flag still works is when the api_tokens table is completely empty (fresh container, no tokens ever created). In that case the code falls through to Create("install"), which generates and prints a new plaintext token. If a token named "install" already exists, that path also fails with "a token with that name already exists".

Workaround (until this is fixed)

1. Panel UI — go to Settings → API Tokens, delete the existing token, create a new one, and copy the plaintext shown immediately after creation.

2. Docker — fresh token via the panel API — if you have temporary access to the panel, create a token through the UI first, then use it for subsequent API calls.

3. Force-create via CLI — if the api_tokens table has no rows (e.g. brand-new container with a blank DB), the flag will create and print one token. You can achieve this by starting with a fresh database volume, running the panel once, and immediately running docker exec 3x-ui /app/x-ui setting -getApiToken before any token is created through the UI.

Expected fix

GetApiToken should detect that existing tokens cannot be retrieved (since only hashes are stored) and either:

• Inform the user that existing tokens are not recoverable, and create a new one, or
• Print the token count and instructions for managing tokens through the panel UI.