---
title: "Mint a personal access token (`chrm_user_*`)"
method: POST
path: "/api/token"
---

# Mint a personal access token (\`chrm_user_\*\`)

`POST /api/token`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/api/token`
- Auth: HTTP bearer

Plaintext returned exactly once. 7-day TTL unless `expiresInDays` picks another lifetime. The legacy `/token` path 308s here.

## Request body

- object
  - `label` string
  - `expiresInDays` integer, nullable: Whole days until the token expires. Choose a longer lifetime for a client that can only hold a static bearer token. A caller using a personal access token can create only default-lifetime tokens; a longer one needs a sign-in session.

## Response `200`

Token minted

- TokenCreateResponse: Minted personal access token. `token` plaintext is returned exactly once.
  - `token` string, required
  - `tokenPrefix` string, required
  - `label` string, nullable
  - `expiresAt` string, date-time, required

## Other responses

- `400`: `label` is longer than 80 characters, or `expiresInDays` is not a whole number from 1 to the maximum (`invalid_request`).
- `401`: User-scoped auth required to mint a token.
- `403`: A caller using a personal access token asked for a lifetime other than the default (`forbidden`).

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)