---
title: "Make a token"
method: POST
path: "/access-tokens"
tags: ["Access tokens"]
---

# Make a token

`POST /access-tokens`

## Request

- Base URL: `https://gorest.co.in/public/v3`
- URL: `https://gorest.co.in/public/v3/access-tokens`
- Auth: HTTP bearer

The answer holds the value once; only its SHA-256 is kept. The new token gets the scopes you name, each of which the calling token must hold (403 otherwise), the calling token's rate limit, and an end within a year that is not after the calling token's own end (a year from now, or the calling token's end if sooner, when none is sent). It is never the primary token, and revoking the calling token later revokes it too.

## Headers

- `Idempotency-Key` string

## Request body

- AccessTokenCreate
  - `expires_at` string, date-time: When the token stops working; within a year, and not after the calling token's own end.
  - `label` string, required: A name to remember the token by; unique among your tokens.
  - `scopes` Scope[], required

## Response `201`

The new token, with its value. Not stored by any cache.

- AccessTokenCreated
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, nullable, required: When the token stops working; null for an older token with no end.
  - `id` string, uuid, required
  - `is_primary` boolean, required: The account's first token; it cannot be revoked.
  - `label` string, required
  - `last4` string, required: The last 4 characters of the value.
  - `made_by` string, uuid, nullable, required: The token that made this one here; revoking that token revokes this one too. null for a token made on the site.
  - `rate_limit` integer, required: Calls a minute.
  - `scopes` Scope[], required
  - `value` string, required: The token itself, shown only in this answer. Send it as `Authorization: Bearer <value>`.

## Other responses

- `400`: A parameter is wrong, unknown or out of range.
- `401`: No token, or the token is wrong, expired or revoked.
- `403`: The token lacks the scope this operation needs.
- `409`: The change clashes with another row, such as an email you already use.
- `413`: The body is over 64 KiB.
- `415`: The body is not `application/json` (or `application/merge-patch+json` on PATCH).
- `422`: The body has fields that fail their rules (`validation_failed`, with `errors`), or a cap is reached (`cap_reached`).
- `429`: Over the rate limit; wait `Retry-After` seconds.
- `500`: Something failed on the server.

---

[API](https://skmtc.dev/gorest/apis/gorest-api-v3.md) - [All operations](https://skmtc.dev/gorest/apis/gorest-api-v3/llms.txt) - [OpenAPI document](https://skmtc.dev/gorest/apis/gorest-api-v3/revisions/89aa429755a6?raw)