---
title: "Create a Chrome extension token (`cke_…`)"
method: POST
path: "/api/extension/token"
tags: ["account"]
---

# Create a Chrome extension token (\`cke_…\`)

`POST /api/extension/token`

## Request

- Base URL: `https://cliponit.app`
- URL: `https://cliponit.app/api/extension/token`
- Auth: API key in cookie `session`

Returns an opaque token **once** (`cke_` + 64 hex), stored SHA-256 only. **Requires the web `session` cookie**: a Bearer (session token, `ck_…` API key or OAuth `cko_…`) is rejected with 401, so a stolen token cannot mint more. The token replaces the session cookie inside the Chrome extension (`Authorization: Bearer cke_…`) and therefore works on **every plan, free included** — unlike the `ck_…` API key, which unlocks the public API and MCP and needs a paid plan. Sliding expiry: 180 days, pushed back on every authenticated call. Max 5 live tokens per account (the oldest is revoked beyond that); rate-limited to 10/h per account and 30/h per IP.

## Request body

- object
  - `label` string: Optional name shown in `GET /api/me/extensions`

## Response `200`

New token (shown once)

- object
  - `token` string, required
  - `expires_in_days` integer

## Other responses

- `401`: Missing or invalid credentials
- `429`: Too many tokens created, retry later

---

[API](https://skmtc.dev/cliponit/apis/cliponit-api.md) · [All operations](https://skmtc.dev/cliponit/apis/cliponit-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cliponit/apis/cliponit-api/revisions/10e3e4327922?raw)