--- title: "Mint a scoped API token for this account." method: POST path: "/v1/tokens" tags: ["tokens"] --- # Mint a scoped API token for this account. `POST /v1/tokens` ## Request - Base URL: `https://api.kody.codes` - URL: `https://api.kody.codes/v1/tokens` - Auth: HTTP bearer Mint a scoped API token for this account. The token value is returned once. Tokens require an explicit lifetime: lifetime "short" (3600s idle / 86400s max) or "long" (1209600s idle / 7776000s max), or both idle_ttl_seconds (60-1209600) and max_lifetime_seconds (up to 7776000). Each successful request slides expires_at forward, never past max_expires_at. At most 500 active tokens per account; a new mint reclaims the active token(s) with the least remaining life (sooner of idle deadline and absolute expiry), never the caller's own token. A token-authenticated caller can only grant scopes it holds and cannot outlive its own max_expires_at. Org permission: none (touches no org data). ## Request body - object - `name` string, required: Label shown in token lists, e.g. `kody-cli on laptop`. - `scopes` string[], required: Org-permission scopes to grant. There is no write-implies-read hierarchy. A token can only mint tokens with scopes it holds. `package:read`: Read saved packages and package-backed resources. `package:execute`: Execute saved packages. `package:write`: Change saved packages and package-backed resources. `package:delete`: Delete saved packages. `package:publish`: Publish packages to the community catalog. `package:manage_access`: Manage package access grants. `app:read`: Read package apps. `app:execute`: Run package apps. `app:write`: Granted `app:write` in this org. `app:delete`: Granted `app:delete` in this org. `app:manage_access`: Granted `app:manage_access` in this org. `job:read`: Read package jobs and workflow runs. `job:execute`: Run package jobs. `job:write`: Granted `job:write` in this org. `job:delete`: Granted `job:delete` in this org. `job:manage_access`: Granted `job:manage_access` in this org. `secret:use`: Use secrets without reading plaintext. `secret:read`: Granted `secret:read` in this org. `secret:write`: Change existing secrets (plaintext is never returned). `secret:delete`: Granted `secret:delete` in this org. `secret:manage_access`: Granted `secret:manage_access` in this org. `integration:use`: Use connected integrations. `integration:read`: Read OAuth integrations and connected MCP servers. `integration:write`: Granted `integration:write` in this org. `integration:delete`: Granted `integration:delete` in this org. `integration:manage_access`: Granted `integration:manage_access` in this org. `memory:read`: Read memories and MCP server instructions. `memory:write`: Change existing memories. `memory:delete`: Granted `memory:delete` in this org. `memory:manage_access`: Granted `memory:manage_access` in this org. `email:read`: Read inboxes and messages. `email:send`: Send email. `email:write`: Granted `email:write` in this org. `email:delete`: Granted `email:delete` in this org. `email:manage_access`: Granted `email:manage_access` in this org. `package:create`: Create saved packages. `app:create`: Granted `app:create` in this org. `job:create`: Granted `job:create` in this org. `secret:create`: Create new secrets. `integration:create`: Granted `integration:create` in this org. `memory:create`: Create new memories. `email:create`: Granted `email:create` in this org. `org:read`: Read this org’s profile, members, and billing summary. `org:write`: Change this org’s profile and settings. `org:delete`: Delete this org. `org:execute`: Run execute and local CapabilityProxy hops for this org (API tokens need this scope; CLI `kody login` OAuth is a separate credential). `search:read`: Run unified Kody search. `member:read`: Read org members. `member:write`: Invite and change org members. `member:delete`: Remove org members. `team:read`: Read teams. `team:write`: Create and change teams. `team:delete`: Delete teams. `billing:read`: Read billing and plan. `billing:write`: Change billing and plan. `audit:read`: Read the org audit log. `token:read`: List and inspect API tokens. `token:delete`: Revoke API tokens. - `org_binding` 'org' | 'user': `org` (default): bind to the current request org. `user`: person-owned token; each call picks an org with `?org=` (default personal). Existing org-bound tokens stay unchanged. - `profile` string: Optional connection profile name. The token’s package access is limited to that profile’s grants. Experimenters only. - `lifetime` 'short' | 'long': Required unless idle_ttl_seconds and max_lifetime_seconds are both set. `short` = 1h idle / 24h max. `long` = 14d idle / 3mo max. Single-task agents should use `short`. - `idle_ttl_seconds` integer: Seconds without use before the token expires. Required with max_lifetime_seconds when lifetime is omitted. - `max_lifetime_seconds` integer: Absolute lifetime cap in seconds. Required with idle_ttl_seconds when lifetime is omitted. ## Response `200` Success. - object - `id` string, required - `name` string, required - `org_id` string, required: For org-bound tokens: the fixed org id. For user-owned tokens: the personal org id (placeholder; each request picks an org via `?org=`). - `org_binding` 'org' | 'user', required: `org`: fixed to org_id. `user`: person-owned; pass `?org=` on each request (default personal org). Membership/grants are checked live. - `scopes` string[], required - `status` 'active' | 'expired' | 'revoked', required - `idle_ttl_seconds` integer, required - `expires_at` string, required: Sliding expiry. Each successful request pushes it forward. - `max_expires_at` string, required: Absolute expiry. The token never outlives it. - `created_via` string, required - `created_at` string, required - `last_used_at` string, nullable, required - `rotated_at` string, nullable, required - `revoked_at` string, nullable, required - `profile_name` string, nullable, required: Named connection profile this token is bound to, or null for unlimited. - `token` string, required: The bearer token. Shown once; Kody stores only a hash. Send it as `Authorization: Bearer `. - `token_type` 'Bearer', required ## Other responses - `400`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `401`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `403`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `404`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `409`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `413`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `429`: Too many requests (edge IP/token limit) or an entitlement / plan-cap limit. Wait at least `Retry-After` seconds before retrying. - `500`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `503`: Error envelope `{ "error": { "code", "message", "details"? } }`. - `default`: Error envelope `{ "error": { "code", "message", "details"? } }`. --- [API](https://skmtc.dev/kody/apis/kody-api.md) · [All operations](https://skmtc.dev/kody/apis/kody-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kody/apis/kody-api/revisions/a020ecedb82b?raw)