diff --git a/cmd/edge-api/main.go b/cmd/edge-api/main.go
index b6895a25..92db6b57 100644
--- a/cmd/edge-api/main.go
+++ b/cmd/edge-api/main.go
@@ -17,6 +17,7 @@ import (
 	"github.com/iwind/gosock/pkg/gosock"
 	"log"
 	"os"
+	"strings"
 )
 
 func main() {
@@ -188,6 +189,38 @@ func main() {
 			}
 		}
 	})
+	app.On("token", func() {
+		var role = ""
+		if len(os.Args) <= 2 {
+			fmt.Println("require --role parameter")
+			return
+		}
+
+		var set = flag.NewFlagSet("", flag.ExitOnError)
+		set.StringVar(&role, "role", "", "edge-api token --role=[admin|user|api]")
+		_ = set.Parse(os.Args[2:])
+
+		var sock = gosock.NewTmpSock(teaconst.ProcessName)
+		reply, err := sock.Send(&gosock.Command{Code: "lookupToken", Params: map[string]any{
+			"role": role,
+		}})
+		if err != nil {
+			fmt.Println("[ERROR]" + err.Error())
+		} else {
+			var resultMap = maps.NewMap(reply.Params)
+			if resultMap.GetBool("isOk") {
+				var tokens = resultMap.GetSlice("tokens")
+				fmt.Printf("%-35s | %-35s\n", "nodeId", "secret")
+				fmt.Println(strings.Repeat("-", 70))
+				for _, tokenMap := range tokens {
+					var m = maps.NewMap(tokenMap)
+					fmt.Printf("%-35s | %-35s\n", m.GetString("nodeId"), m.GetString("secret"))
+				}
+			} else {
+				fmt.Println("[ERROR]" + resultMap.GetString("err"))
+			}
+		}
+	})
 
 	app.Run(func() {
 		nodes.NewAPINode().Start()
diff --git a/internal/nodes/api_node.go b/internal/nodes/api_node.go
index 861feeb4..16af1582 100644
--- a/internal/nodes/api_node.go
+++ b/internal/nodes/api_node.go
@@ -755,6 +755,41 @@ func (this *APINode) listenSock() error {
 						"code": teaconst.InstanceCode,
 					},
 				})
+			case "lookupToken":
+				var role = maps.NewMap(cmd.Params).GetString("role")
+				switch role {
+				case "admin", "user", "api":
+					tokens, err := models.SharedApiTokenDAO.FindAllEnabledAPITokens(nil, role)
+					if err != nil {
+						_ = cmd.Reply(&gosock.Command{
+							Params: map[string]any{
+								"isOk": false,
+								"err":  err.Error(),
+							},
+						})
+					} else {
+						var tokenMaps = []maps.Map{}
+						for _, token := range tokens {
+							tokenMaps = append(tokenMaps, maps.Map{
+								"nodeId": token.NodeId,
+								"secret": token.Secret,
+							})
+						}
+						_ = cmd.Reply(&gosock.Command{
+							Params: map[string]any{
+								"isOk":   true,
+								"tokens": tokenMaps,
+							},
+						})
+					}
+				default:
+					_ = cmd.Reply(&gosock.Command{
+						Params: map[string]any{
+							"isOk": false,
+							"err":  "unsupported role '" + role + "'",
+						},
+					})
+				}
 			}
 		})