---
title: "POST /api/v3/accounts/{account_id}/service-tokens/"
method: POST
path: "/api/v3/accounts/{account_id}/service-tokens/"
tags: ["Service Tokens"]
---

# POST /api/v3/accounts/{account_id}/service-tokens/

`POST /api/v3/accounts/{account_id}/service-tokens/`

## Request

- Base URL: `https://cloud.getdbt.com`
- URL: `https://cloud.getdbt.com/api/v3/accounts/{account_id}/service-tokens/`
- Auth: HTTP bearer

This endpoint is used to generate a new service token for the account.

## Path parameters

- `account_id` integer, required

## Request body

- CreateServiceTokenRequestRequest: Base class for all request payloads. It is expected that each endpoint extends this class to define its own payload format
  - `name` string, required: The name of the service token
  - `permission_grants` ServiceTokenPermissionGrant[]: Permissions to assign to the service token
    - `permission_set` 'account_admin' | 'account_viewer' | 'admin' | 'analyst' | 'analyst_read' | 'billing_admin' | 'cost_insights_admin' | 'cost_insights_viewer' | 'cost_management_admin' | 'cost_management_viewer' | 'database_admin' | 'developer' | 'fusion_admin' | 'git_admin' | 'job_admin' | 'job_creator' | 'job_runner' | 'job_viewer' | 'manage_marketplace_apps' | 'member' | 'metadata_only' | 'notification_manager' | 'owner' | 'project_creator' | 'readonly' | 'scim_only' | 'security_admin' | 'semantic_layer_only' | 'stakeholder' | 'team_admin' | 'webhooks_only', required: An enumeration.
    - `project_id` integer: The project to which the permissions are scoped. If none, then the permissions apply to all projects.
    - `writable_environment_categories` string[]: Environment types the permission set can write to. Allowed values: development, other, staging, production, all. `other` is shown as General in the dbt UI.
  - `expires_at` string, date-time: When the token stops authenticating. Omit for no expiry. Must be in the future, no more than 365 days out, with a timezone offset.
  - `metadata_only` boolean: Deprecated. Use the metadata_only permission set instead.
  - `webhooks_only` boolean

## Response `200`

- DetailCreateServiceTokenResponse
  - `status` Status
    - `code` integer
    - `is_success` boolean
    - `user_message` string
    - `developer_message` string
  - `data` CreateServiceToken, required
    - `id` integer, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `account_id` integer, required: The account the service token is associated with
    - `uid` string, required: The unique identifier for the service token
    - `name` string, required: The name of the service token
    - `state` integer, required: The liveness state of the service token. A value of 1 means this entity is active and a value of 2 means this entity is deleted
    - `permission_grants` ServiceTokenPermissionGrant[]: The permissions to be assigned to the service token
      - `permission_set` 'account_admin' | 'account_viewer' | 'admin' | 'analyst' | 'analyst_read' | 'billing_admin' | 'cost_insights_admin' | 'cost_insights_viewer' | 'cost_management_admin' | 'cost_management_viewer' | 'database_admin' | 'developer' | 'fusion_admin' | 'git_admin' | 'job_admin' | 'job_creator' | 'job_runner' | 'job_viewer' | 'manage_marketplace_apps' | 'member' | 'metadata_only' | 'notification_manager' | 'owner' | 'project_creator' | 'readonly' | 'scim_only' | 'security_admin' | 'semantic_layer_only' | 'stakeholder' | 'team_admin' | 'webhooks_only', required: An enumeration.
      - `project_id` integer: The project to which the permissions are scoped. If none, then the permissions apply to all projects.
      - `writable_environment_categories` string[]: Environment types the permission set can write to. Allowed values: development, other, staging, production, all. `other` is shown as General in the dbt UI.
    - `last_used` string, date-time: The time the service token was last used
    - `expires_at` string, date-time: When the token stops authenticating. Null means it never expires.
    - `semantic_layer_credentials` object[]
    - `metadata_only` boolean: Deprecated. Use the metadata_only permission set instead.
    - `webhooks_only` boolean
    - `token` string: The hashed token secret
    - `token_string` string, required: The full token string used to authenticate clients
    - `last_identify` string, date-time
    - `user_id` integer
    - `user` object
    - `type` 1 | 2 | 3 | 4: An enumeration.
    - `service_token_permissions` object[]
  - `extra` object
  - `error_code` integer

## Changes

- **2026-11-05** (v3) `2448b375ac2f`: 3 info
  - added the new optional request property `expires_at` (media type: application/json)
  - added the new optional request property `expires_at` (media type: application/x-www-form-urlencoded)
  - added the new optional request property `expires_at` (media type: multipart/form-data)
- **2026-10-06** (v3) `fac88ef7e8f8`: 3 breaking
  - the `permission_grants/items/project_id` request property format changed from no format to `int64` (media type: application/json)
  - the `permission_grants/items/project_id` request property format changed from no format to `int64` (media type: application/x-www-form-urlencoded)
  - the `permission_grants/items/project_id` request property format changed from no format to `int64` (media type: multipart/form-data)
- **2026-10-06** (v3) `7d5c1b4c8d8a`: 1 breaking
  - for the `path` request parameter `account_id`, the format changed from no format to `int64`
- …earlier changes not shown

[Operation history](https://skmtc.dev/getdbt/apis/dbt-cloud-api-v2/changes/api/v3/accounts/:account_id/service-tokens/post.md)

---

[API](https://skmtc.dev/getdbt/apis/dbt-cloud-api-v2.md) - [All operations](https://skmtc.dev/getdbt/apis/dbt-cloud-api-v2/llms.txt) - [OpenAPI document](https://skmtc.dev/getdbt/apis/dbt-cloud-api-v2/revisions/2448b375ac2f?raw)