---
title: "Create a session token"
method: POST
path: "/token"
tags: ["Components"]
---

# Create a session token

`POST /token`

Creates a short-lived session token for the Auth Component.

## Response `201`

Created

- CreateSessionTokenResponse — A session token for the Auth Component. Short-lived (30 minutes) and scoped to a single component session.
  - `id` string, required — Unique identifier for the session token, prefixed with `tok_`.
  - `object` string, required — Always `token`.
  - `token` string, required — The token value to pass to `<DeckAuthComponent />`. Prefixed with `tk_`. Treat as a bearer secret until it expires.
  - `expires_at` string, date-time, required — ISO 8601 timestamp at which the token stops being accepted. 30 minutes after `created_at`.
  - `created_at` string, date-time, required — ISO 8601 timestamp of when the token was created.
  - `request_id` string, required — Unique identifier for the API request. Include this when contacting support.

## Other responses

- `401` — Unauthorized.
- `403` — Forbidden.
- `404` — JSON error. Typed `errors[]` with machine-readable `type`/`code` plus `request_id`.
- `409` — JSON error. Typed `errors[]` with machine-readable `type`/`code` plus `request_id`.
- `422` — JSON error. Typed `errors[]` with machine-readable `type`/`code` plus `request_id`.
- `429` — Too many requests or session concurrency exceeded. Retry with backoff; honor Retry-After and RateLimit headers when present.
- `500` — Internal server error.

---

[API](https://skmtc.dev/deck/apis/deck-api.md) · [All operations](https://skmtc.dev/deck/apis/deck-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/deck/deck-api/revisions/eba6e2cc9351/schema)