diff --git a/src/js/sw/surfaces/admin/users.js b/src/js/sw/surfaces/admin/users.js
index 67bc994..041cc8a 100644
--- a/src/js/sw/surfaces/admin/users.js
+++ b/src/js/sw/surfaces/admin/users.js
@@ -91,7 +91,7 @@ export default function UsersSection() {
         const name = await sw.prompt(`Token name for "${username}":`, '');
         if (!name) return;
         try {
-            const resp = await sw.api.fetch('POST', '/admin/tokens', {
+            const resp = await sw.api.post('/api/v1/admin/tokens', {
                 user_id: userId, name, permissions: [],
             });
             await sw.alert(`Token created for ${username}. Copy it now — it won't be shown again:\n\n${resp.token}`);
diff --git a/src/js/sw/surfaces/settings/tokens.js b/src/js/sw/surfaces/settings/tokens.js
index b23a20f..a741cb8 100644
--- a/src/js/sw/surfaces/settings/tokens.js
+++ b/src/js/sw/surfaces/settings/tokens.js
@@ -20,8 +20,8 @@ export function TokensSection() {
 
     const load = useCallback(async () => {
         try {
-            const resp = await sw.api.fetch('GET', '/auth/tokens');
-            setTokens(resp?.data || []);
+            const resp = await sw.api.get('/api/v1/auth/tokens');
+            setTokens(resp || []);
         } catch (e) {
             setTokens([]);
         }
@@ -29,7 +29,7 @@ export function TokensSection() {
 
     const loadPerms = useCallback(async () => {
         try {
-            const resp = await sw.api.fetch('GET', '/profile/permissions');
+            const resp = await sw.api.get('/api/v1/profile/permissions');
             setAvailablePerms(resp?.permissions || []);
         } catch (_) {}
     }, []);
@@ -65,7 +65,7 @@ export function TokensSection() {
         try {
             const body = { name: form.name, permissions: form.permissions };
             if (form.expires_at) body.expires_at = new Date(form.expires_at).toISOString();
-            const resp = await sw.api.fetch('POST', '/auth/tokens', body);
+            const resp = await sw.api.post('/api/v1/auth/tokens', body);
             setCreatedToken(resp.token);
             setShowForm(false);
             load();
@@ -80,7 +80,7 @@ export function TokensSection() {
     const revoke = useCallback(async (id, name) => {
         if (!await sw.confirm(`Revoke token "${esc(name)}"? This action cannot be undone.`)) return;
         try {
-            await sw.api.fetch('DELETE', `/auth/tokens/${id}`);
+            await sw.api.del(`/api/v1/auth/tokens/${id}`);
             sw.emit('toast', { message: 'Token revoked', variant: 'success' });
             load();
         } catch (e) {