---
title: "POST /v1/users/me/pats — mint a new personal access token (session-auth only)."
method: POST
path: "/v1/users/me/pats"
tags: ["personal-access-tokens"]
---

# POST /v1/users/me/pats — mint a new personal access token (session-auth only).

`POST /v1/users/me/pats`

The raw token is returned **once** in the response. Only its SHA-256 hash
plus a short display prefix are persisted. PATs act as the authenticated
user across the platform — they cannot be created by other PATs to keep
the trust root anchored at a verified browser session, matching
GitHub/Stripe semantics.

## Request body

- CreatePersonalAccessTokenRequest — POST /v1/users/me/pats
  - `expires_at` string, date-time, nullable — Optional ISO-8601 expiry. Omitted = no expiry.
  - `name` string, required — Human-readable label for the token (e.g. "macbook-cli").

## Response `200`

PAT created (raw token returned once)

- CreatePersonalAccessTokenResponse — Returned to the caller once on creation — includes the full plaintext token.
  - `created_at` string, date-time, required
  - `expires_at` string, date-time, nullable
  - `id` string, uuid, required
  - `name` string, required
  - `prefix` string, required
  - `token` string, required — Raw bearer token in the form `msb_pat_<env>_<random>`. Surfaced once.

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — PATs cannot mint other PATs

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)