---
title: "Create service-account token"
method: POST
path: "/api/organizations/{name}/service-accounts/{serviceAccountId}/tokens"
tags: ["service-accounts"]
---

# Create service-account token

`POST /api/organizations/{name}/service-accounts/{serviceAccountId}/tokens`

Create a new access token for a service account. Store the token securely - it cannot be retrieved later.

## Path parameters

- `name` string, required
- `serviceAccountId` string, required

## Request body

- object
  - `displayName` string — Display name for the token
  - `permissions` string[] — Org-wide permissions for this token
  - `repoIds` string[] — Repositories to grant `repoPermissions` on. Can be repositories owned by the organization or any public repository. These override the org-wide permissions.
  - `repoPermissions` string[] — Permissions granted on the selected `repoIds`.
  - `endpointPatterns` string[] — Inference endpoint name patterns (wildcards allowed, e.g. `gpt2-*`) restricting the token's org-wide Inference Endpoint permissions to matching endpoints. Empty means all endpoints.
  - `skipNetworkSecurity` boolean — Exempt this token from the org's Network Security enforcement (IP allowlist and content access policy). Enterprise Plus only, and requires the `org.networkSecurity.write` permission.

## Response `201`

Created token

- object
  - `token` string, required — The access token - store this securely, it cannot be retrieved later
  - `tokenInfo` object, required
    - `_id` string, required
    - `displayName` string, required
    - `createdAt` string, required
    - `permissions` string[]
    - `repoIds` string[], required
    - `repoPermissions` string[], required
    - `endpointPatterns` string[], required
    - `skipNetworkSecurity` boolean, required

## Changes

- **2026-09-08** `bd17546f47b8` — 2 breaking
  - the `permissions/items/` request property type changed from no type to `string`
  - the `repoPermissions/items/` request property type changed from no type to `string`
- **2026-08-19** `bfd4937641f1` — 1 info
  - added the new `org.auditLog.write` enum value to the request property `permissions/items/`
- **2026-08-05** `17e54bbf244f` — 2 info
  - added the new optional request property `skipNetworkSecurity`
  - added the required property `tokenInfo/skipNetworkSecurity` to the response with the `201` status
- **2026-07-26** `36390f25f00f` — 8 info
  - added the new optional request property `endpointPatterns`
  - added the new optional request property `repoIds`
  - added the new optional request property `repoPermissions`
  - the request property `permissions` became optional
  - …4 more

[Change history](https://skmtc.dev/huggingface/apis/hub-api-endpoints/changes/api/organizations/:name/service-accounts/:serviceAccountId/tokens/post.md)

---

[API](https://skmtc.dev/huggingface/apis/hub-api-endpoints.md) · [All operations](https://skmtc.dev/huggingface/apis/hub-api-endpoints/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingface/apis/hub-api-endpoints/revisions/b88d4a4da99f?raw)