---
title: "Issue a short-lived scoped token"
method: POST
path: "/api/v1/scoped-tokens"
tags: ["credentials"]
---

# Issue a short-lived scoped token

`POST /api/v1/scoped-tokens`

## Request

- Base URL: `https://api.agenticcontrolplane.com`
- URL: `https://api.agenticcontrolplane.com/api/v1/scoped-tokens`
- Auth: HTTP bearer

Issues an opaque, short-lived ACP-managed token bound to the calling user's stored OAuth credential for a provider — the agent never sees the underlying vendor token. 409 with a `connectUrl` when the provider isn't connected yet. Per-tenant feature flag; 404 when disabled. Rate limited per tenant.

## Request body

- object
  - `provider` string, required: Canonical lowercase provider key (e.g. "github", "google", "slack").
  - `scopes` string[]: Optional narrowing; cannot widen beyond the user's OAuth grant.
  - `ttlSeconds` integer
  - `reason` string

## Response `200`

The scoped token (returned once).

- object
  - `ok` boolean

## Other responses

- `400`: Validation failed.
- `401`: Missing, malformed, invalid, or revoked gsk_ API key.
- `403`: No associated user.
- `404`: Feature disabled.
- `409`: Provider not connected — response carries a connectUrl.
- `429`: Rate limited. Standard draft-7 RateLimit / RateLimit-Policy headers are set; retry after the window resets.
- `500`: Server error.

---

[API](https://skmtc.dev/agenticcontrolplane/apis/agentic-control-plane-gateway-api.md) · [All operations](https://skmtc.dev/agenticcontrolplane/apis/agentic-control-plane-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agenticcontrolplane/apis/agentic-control-plane-gateway-api/revisions/161819f3df00?raw)