---
title: "Create Resource Token"
method: POST
path: "/api/v1/resource-tokens"
tags: ["resource-tokens"]
---

# Create Resource Token

`POST /api/v1/resource-tokens`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/resource-tokens`
- Auth: none declared

Create a new resource token.

Issue #242: Owner-only access. Returns plaintext token ONLY once.
Issue #276: Uses WorkspaceOwner dependency for DRY principle.

The token cap is the WORKSPACE's (#1919): the count of active,
non-connector tokens of the workspace — whoever minted them — must be
under the plan's ``max_resource_tokens``. It used to be counted per
creator, while the quota ceiling on PATCH was summed per workspace, so
two owners could each mint a full set and leave the workspace with no
quota raise that fitted. The population is the ceiling's
(``auth.resource_tokens.workspace_regular_active_tokens``); the sum itself is not checked
here because count <= cap and quota <= 10000 per token already keep it
at or under ``max_resource_tokens * 10000``.

Args:
    data: Token creation request
    owner: Workspace owner (user_id, workspace_id) from dependency
    manager: ResourceTokenManager instance
    db: Database session

Returns:
    Token metadata + plaintext token (shown ONLY once)

Raises:
    400: Invalid resource_id
    403: Not workspace owner, plan without the feature, or the workspace
        is at its token cap (``QUOTA-001``)
    500: Failed to create token

## Headers

- `authorization` string, nullable

## Request body

- ResourceTokenCreate: Request model for creating a resource token.
  - `resource_id` string, required: Resource identifier this token is scoped to
  - `description` string, nullable: Human-readable description
  - `quota_events_per_hour` integer: Event ingestion quota per hour (default: 1000)

## Response `201`

Successful Response

- ResourceTokenCreateResponse: Response model for resource token creation (includes plaintext token). WARNING: The `token` field is shown ONLY once. Client must save it immediately.
  - `id` unknown, required
  - `resource_id` unknown, required
  - `description` unknown
  - `quota_events_per_hour` unknown, required
  - `created_by` unknown
  - `created_at` unknown, required
  - `last_used_at` unknown
  - `is_active` unknown, required
  - `status` unknown, required
  - `token` unknown, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/09f17f5ada29?raw)