---
title: "Create Sub-Account User Token"
method: POST
path: "/api/v1/sub-accounts/etoro-trading/user-tokens"
tags: ["Sub-Accounts - eToro Trading"]
---

# Create Sub-Account User Token

`POST /api/v1/sub-accounts/etoro-trading/user-tokens`

## Request

- Base URL: `https://public-api.etoro.com`
- URL: `https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens`
- Auth: OAuth 2
  - Authorization code
  - Scopes: `etoro-public:sub-accounts:write`
- TypeScript: <https://skmtc.dev/etoro/apis/etoro-api/docs/api/v1/sub-accounts/etoro-trading/user-tokens/post.ts> (a function with typed inputs; its response is checked against the schema)

**Rate limit:** 60 requests per 60 seconds. This is the **default shared quota** — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

---

Generates a non-interactive user token for the sub-account identified by the x-sub-account-id header. The secret token value is returned only once, in this response.

## Headers

- `x-request-id` string, uuid, required
- `x-api-key` string, password, required
- `x-user-key` string, password, required
- `x-sub-account-id` string, required

## Request body

- CreateSubAccountUserTokenRequest
  - `userTokenName` string, required: A friendly display name for the user token.
  - `scopeNames` string[], required: The scope names to assign. Must be a subset of the scopes returned by GET /api/v1/sub-accounts/etoro-trading/user-tokens/scopes.
  - `ipsWhitelist` string[]: An optional IPv4 whitelist for the token.
  - `expiresAt` string, date-time: An optional UTC expiration for the token.

## Response `201`

User token created successfully

- EtoroTradingSubAccountsOperationsApiCreateUserTokenResponse
  - `userTokenId` string, uuid: The unique identifier of the created user token.
  - `userToken` string: The secret token value. Returned only once, on creation.
  - `userTokenName` string: The friendly display name assigned to the token.
  - `clientId` string, uuid: The OAuth client id associated with the token.
  - `ipsWhitelist` string[]: The IPv4 addresses the token is restricted to, if any.
  - `scopes` ScopeNameItem[]: The scopes granted to the token.
    - `name` string: The permission scope name.
  - `expiresAt` string, date-time, nullable: The UTC expiration of the token, if one was set.
  - `createdAt` string, date-time: When this user token was created.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden — a requested scope name is not allowed, or the sub-account is not owned by the caller
- `409`: Conflict — a user token with the requested name already exists for this sub-account
- `429`: Too Many Requests — the per-user token cap was exceeded, or a downstream dependency is throttling requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/etoro/apis/etoro-api.md) - [All operations](https://skmtc.dev/etoro/apis/etoro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/etoro/apis/etoro-api/revisions/69c1fb266c35?raw)