---
title: "Create a self-service reader token for persistent saves, collections, and watchlists."
method: POST
path: "/api/account/reader-token"
tags: ["Library", "Accounts"]
---

# Create a self-service reader token for persistent saves, collections, and watchlists.

`POST /api/account/reader-token`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/account/reader-token`
- Auth: none declared

Returns a one-time reader bearer token. Hugging Bay stores only the token hash. Reader tokens cannot publish artifacts or approve mirrors.

**Inputs.** No path or query fields are required. The request body schema lists accepted fields and required values.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Token creation has separate visitor and IP budgets: 3 requests per 3600 seconds. Reuse an existing token; on 429 read Retry-After. A missing trusted client address can return 503 without creating a token.

**Example setup.** This example is not executed by documentation checks. Review the operation and obtain any required user consent before sending it.

## Request body

- object
  - `displayName` string
  - `purpose` string

## Response `201`

Reader token issue document

- object
  - `schemaVersion` 'hugging-bay.reader-token-issue.v1', required
  - `generatedAt` string, date-time, required
  - `principal` Principal, required
    - `id` string, required
    - `role` 'visitor' | 'reader' | 'publisher' | 'admin', required
    - `allowedOwners` string[], required
  - `apiKey` ReaderApiKey, required
    - `id` string, required
    - `principalId` string, required
    - `role` 'reader', required
    - `displayName` string
    - `allowedOwners` string[]
    - `status` 'active' | 'revoked', required
    - `tokenPrefix` string, required
    - `createdAt` string, required
    - `revokedAt` string
    - `purpose` string
  - `actions` object, required
  - `guidance` string[], required

## Other responses

- `400`: Invalid reader-token request; only displayName and purpose strings are accepted
- `429`: Rate limited
- `503`: A trusted client address is unavailable; no reader token was created

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/ea7ba26b1e27?raw)