---
title: "Create Token"
method: POST
path: "/tokens"
tags: ["Access"]
---

# Create Token

`POST /tokens`

## Request

- Base URL: `https://api.hedra.com/v3`
- URL: `https://api.hedra.com/v3/tokens`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP bearer

## Request body

- TokenCreateRequest
  - `ttl_seconds` integer, nullable: Seconds until the token expires; omitted means the service default.
  - `scopes` ApiKeyScope[], nullable: Scopes granted to the token. Omitted means every scope of the minting key except the opt-in `sandboxes:read`, `sandboxes:write` and `sandboxes:exec`, which a token holds only by listing them; an explicit subset narrows the grant, and requesting beyond the key's scopes is a 403.

## Response `201`

Successful Response

- TokenCreateResponse
  - `token` string, required: The ephemeral token — a valid Bearer credential until it expires. Shown exactly once.
  - `expires_at` string, date-time, nullable: ISO-8601 instant the token stops authenticating.

## Other responses

- `400`: Invalid or failed-validation request.
- `401`: Authentication failed: missing, malformed, or invalid credentials.
- `403`: Insufficient scope or plan.
- `404`: Resource not found.
- `429`: Rate limit exceeded.
- `500`: Internal error.

## Changes

- **2026-10-23** `e733493214f4`: 3 info
  - added the new `sandboxes:exec` enum value to the request property `scopes/anyOf[subschema #1]/items/`
  - added the new `sandboxes:read` enum value to the request property `scopes/anyOf[subschema #1]/items/`
  - added the new `sandboxes:write` enum value to the request property `scopes/anyOf[subschema #1]/items/`
- **2026-10-16** `06692d16e78a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hedra-labs/apis/hedra-api/changes/tokens/post.md)

---

[API](https://skmtc.dev/hedra-labs/apis/hedra-api.md) - [All operations](https://skmtc.dev/hedra-labs/apis/hedra-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hedra-labs/apis/hedra-api/revisions/6ef35a11cefe?raw)