--- title: "Create token" method: POST path: "/v2/storage/tokens" tags: ["Tokens and Permissions"] --- # Create token `POST /v2/storage/tokens` ## Request - Base URL: `https://connection.keboola.com` - URL: `https://connection.keboola.com/v2/storage/tokens` - Auth: one of: - API key in header `X-StorageApi-Token` - API key in header `X-KBC-ManageApiToken` - HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Creates a new token in the project. Note that it is not possible to create a new master token. If your admin token does not have the `canManageTokens` permission, you can only create a temporary token with minimal privileges. In this case, you are allowed to set the `description` and token expiration via the `expiresIn` parameter. All other attributes will be ignored. Creating a token with `canManageProtectedDefaultBranch` additionally requires an application token with scope `storage:tokens:create-protected-default-branch-privileged` in the `X-KBC-ManageApiToken` header. ## Request body - union - TokenCreateRequest: Full token create request, used when the authorizing token has `canManageTokens`. - `description` string, nullable: Token description. - `bucketPermissions` object: Permissions per bucket, keyed by bucket ID. Available permissions: `read`, `write`. - `componentAccess` string[]: Grants access for component configurations. Allowed values are valid component IDs. - `canManageBuckets` boolean: Allows full access to all buckets including newly created buckets. Overrides `bucketPermissions` settings. - `canReadAllFileUploads` boolean: Allows access to all file uploads. When set to false, only files uploaded by the current token are accessible. - `canPurgeTrash` boolean: Allows permanently removing deleted configurations. - `expiresIn` integer, nullable: Number of seconds until the token expires. If not provided, the token never expires. - `canManageProtectedDefaultBranch` boolean: [EXPERIMENTAL] If set to true, the token will have privileged access to the default branch of the project. Implicitly `false` for the read-only role. Requests using this parameter must also be authenticated with an application token with scope `storage:tokens:create-protected-default-branch-privileged`. - `canCreateJobs` boolean: Token permission to create jobs. Also grants access to component configurations and development branches needed to run them. In projects with the protected default branch only the productionManager role can create such tokens. Mutually exclusive with all other permission attributes. - `canReadAllProjectEvents` boolean: Allows reading all project events, not only the events of the token itself. - `canManageDevBranches` boolean: Allows creating and deleting development branches. - TokenCreateLimitedRequest: Limited token create request, used when the authorizing token does not have `canManageTokens`. Only a temporary token with minimal privileges can be created; all other attributes are ignored. - `description` string, nullable: Token description. - `expiresIn` integer, nullable: Number of seconds until the token expires. If not provided, the token never expires. ## Response `200` Created token including its decrypted `token` value. - TokenCreateResponse - `id` string, required: Unique identifier of the token. - `created` string, nullable, required: Token creation timestamp, ISO 8601 with a `+hhmm` offset. - `refreshed` string, nullable, required: Token last refresh timestamp, ISO 8601 with a `+hhmm` offset. - `description` string, required: User-provided description of the token. - `uri` string, required: URI of the token detail. - `isMasterToken` boolean, required: Whether this is a master (admin) token. - `canManageBuckets` boolean, required: Token permission to manage all buckets. - `canManageTokens` boolean, required: Token permission to manage tokens. - `canReadAllFileUploads` boolean, required: Token permission to read all file uploads. - `canPurgeTrash` boolean, required: Token permission to permanently remove deleted configurations. - `canManageProtectedDefaultBranch` boolean, required: Token permission to manage the protected default branch. - `canCreateJobs` boolean, required: Token permission to create jobs. - `canReadAllProjectEvents` boolean, required: Token permission to read all project events. - `canManageDevBranches` boolean, required: Token permission to manage development branches. - `expires` string, nullable, required: Expiration timestamp of the token, ISO 8601 with a `+hhmm` offset; null when the token never expires. - `isExpired` boolean, required: Whether the token is expired. - `isDisabled` boolean, required: Whether the token is disabled. - `dailyCapacity` integer, required: Daily capacity of the token. - `token` string: Decrypted token value. Present only in the create response; omitted on update. - `creatorToken` object: Token that created this token. Present only when the token was created by another token. - `id` integer, required: ID of the creator token. - `description` string, required: Description of the creator token. - `actor` ActorResponse, required: Who performed the action and through which credential. - `type` 'token' | 'session' | 'pat' | 'system', required: Credential the action came through: a Storage token, a programmatic session, a personal access token, or system work. - `id` string, required: Token id as a string, session or personal access token UUID, or the system subject. - `name` string, required: Token description, the admin email for a session or personal access token, or the system label, as it was when the action happened. - `adminId` integer, nullable, required: Admin behind the credential; null for a token without an admin, for system work, and when the admin was not recorded (an object whose creator is known only from its token columns, including rows backfilled from them). - `componentAccess` string[]: Component IDs the token may access. Present only when at least one component is granted. - `bucketPermissions` object, required: Bucket permissions keyed by bucket ID (`read`, `write` or `manage`). ## Other responses - `400`: Invalid request body (`storage.tokens.validation`), invalid `expiresIn` (`storage.tokens.expiresValidation`) or a missing parameter of a limited token (`storage.tokens.missingParam`). - `403`: The authorizing token may not create tokens with the requested privileges (`accessDenied`), or a credential issued by agent provisioning asked for a token without `expiresIn` of 3600 seconds or less (`storage.tokens.agentCredentialNotAllowed`). - `404`: Requested bucket or component permissions are invalid, e.g. the bucket does not exist (`storage.tokens.invalidPermissions`). --- [API](https://skmtc.dev/keboola/apis/keboola-storage-api.md) - [All operations](https://skmtc.dev/keboola/apis/keboola-storage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keboola/apis/keboola-storage-api/revisions/34b5ceac0317?raw)