---
title: "Create Token"
method: POST
path: "/api/v2/oauth/tokens"
tags: ["OAuth Tokens"]
---

# Create Token

`POST /api/v2/oauth/tokens`

Returns an OAuth access token with a specified [scope](#scopes).

Refresh tokens aren't used. An access token doesn't expire but it can be [revoked](#revoke-token).

For a tutorial, see [Creating and using OAuth tokens with the API](/documentation/ticketing/working-with-oauth/creating-and-using-oauth-tokens-with-the-api/).

**Note**: For OAuth authorization code, use the [Create Token for Grant Type](/api-reference/ticketing/oauth/grant_type_tokens/#create-token-for-grant-type) endpoint.
The two APIs don't share the same path, JSON format, or request parameters. However, both APIs return access tokens that can be used to [authenticate API requests](/api-reference/ticketing/introduction/#oauth-access-token).

#### Allowed For

* Admins

#### Request parameters

The POST request takes a "token" object that contains an OAuth client's resource id and scopes.

| Name      | Type    | Description
| --------- | ------- | --------------------------------------------------
| client_id | integer | The resource `id` of an [OAuth client](/api-reference/ticketing/oauth/oauth_clients/#json-format) (not the client's unique identifier). For the ids, see [List Clients](/api-reference/ticketing/oauth/oauth_clients/#list-clients)
| scopes    | array   | Valid scopes for the token. See [Scopes](#scopes) below

#### Scopes

The **scopes** parameter defines whether requests authenticated with the token can
post, put, and delete data, or only get data.

**Note**: Don't confuse the **scopes** parameter (plural) with the **scope** parameter (singular)
for [grant-type tokens](/api-reference/ticketing/oauth/grant_type_tokens/).

The **scopes** parameter is an array of strings, each specifying a resource name and
an access setting. Access is either "read" or "write". If you don't specify a resource,
access to all resources is assumed. If you don't specify the access, read and write
access are assumed.

The syntax is as follows:

`"scopes": [resource:scope, ...]`

where `resource` is optional.

**Examples**

`"scopes": ["read"]`

`"scopes": ["tickets:read"]`

To give read and write access to a resource, specify both scopes:

`"scopes": ["users:read", "users:write"]`

To give write access only to one resource and read access to everything
else:

`"scopes": ["organizations:write", "read"]`

**Note**: The endpoint returns an access token even if you specify an
invalid scope. Any request you make with the token will return
a "Forbidden" error.

**Available scopes**

* `read` - gives access to GET endpoints. Includes
permission to sideload related resources
* `write` - gives access to POST, PUT, and DELETE endpoints
* `impersonate` - allows Zendesk Support admins to make requests on behalf of
end users. See [Making API requests on behalf of end users](/documentation/ticketing/using-the-zendesk-api/making-api-requests-on-behalf-of-end-users/)

**Resources that can be scoped**

* tickets
* users
* auditlogs (read only)
* organizations
* hc
* apps
* triggers
* automations
* targets
* webhooks
* macros
* requests
* satisfaction_ratings
* dynamic_content
* any_channel (write only)
* web_widget (write only)

## Response `201`

Created response

- OAuthTokenResponse
  - `token` OauthTokenObject
    - `client_id` integer — The id of the client this token belongs to
    - `created_at` string, date-time — The time the token was created
    - `expires_at` string, date-time — The time the token will expire
    - `id` integer — Automatically assigned upon creation
    - `refresh_token` string — The refresh token, if generated
    - `refresh_token_expires_at` string, date-time — The time the refresh token will expire
    - `scopes` string[] — An array of the valid scopes for this token. See [Scopes](#scopes) below
    - `token` string — The access token
    - `url` string — The API url of this record
    - `used_at` string, date-time — The latest time this token was used for authentication
    - `user_id` integer — The id of the user this token authenticates as

---

[API](https://skmtc.dev/botbrains-io/apis/support-api.md) · [All operations](https://skmtc.dev/botbrains-io/apis/support-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/botbrains-io/support-api/revisions/d53eac07ba68/schema)