---
title: "Create a personal access token"
method: POST
path: "/api/my-account/personal-access-tokens"
tags: ["My account"]
---

# Create a personal access token

`POST /api/my-account/personal-access-tokens`

## Request

- Base URL: `https://[tenant_id].logto.app`
- URL: `https://[tenant_id].logto.app/api/my-account/personal-access-tokens`
- Auth: OAuth 2 (client credentials, token URL `/oidc/token`, scopes: `all`)

Create a personal access token for the signed-in user. A logto-verification-id in header and the personal-access-tokens scope are required. The token secret value is returned only in this response. The expiration time is required, must be in the future, and must be at most 365 days from now. A user can have at most 20 unexpired personal access tokens.

## Request body

- object
  - `name` string, required: The name of the token. It must be unique among the user's personal access tokens.
  - `expiresAt` number, required: The epoch time in milliseconds when the token expires. It must be in the future and at most 365 days from now.

## Response `201`

The personal access token was created successfully. The response includes the token secret value, which cannot be retrieved again.

- object
  - `name` string, required
  - `createdAt` number, required
  - `expiresAt` number, nullable, required
  - `value` string, required

## Other responses

- `400`: The request body is invalid, the personal access token field is not editable in the account center, or the expiration time is not in the future or more than 365 days from now.
- `401`: Permission denied, recent user authentication is required or the access token does not include the `personal-access-tokens` scope to create a personal access token.
- `403`: The request was made by a third-party application.
- `422`: The token name already exists, or the user has reached the maximum number of unexpired personal access tokens.

## Changes

- **2026-10-22** `0598176e010d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/logto/apis/logto-api-references/changes/api/my-account/personal-access-tokens/post.md)

---

[API](https://skmtc.dev/logto/apis/logto-api-references.md) - [All operations](https://skmtc.dev/logto/apis/logto-api-references/llms.txt) - [OpenAPI document](https://skmtc.dev/logto/apis/logto-api-references/revisions/beed1405186a?raw)