Tokens

Create a developer token (all tiers; requires the tokensManage scope)

Creates a persistent Bearer token for API access. The raw token is returned only once in the response — store it securely. Available on every tier — token management is a security primitive, not a paid feature. Requires a bearer with the tokensManage scope and every requested scope. A caller cannot mint authority it does not hold. This is scope enforcement, never a subscription tier requirement.

post/v1/tokens

Request

  • Base URL: http://localhost:9998
  • URL: http://localhost:9998/v1/tokens
  • Auth: HTTP bearer

Request body

labelstring

Human-readable label for the token

scopesstring[] required

Required, non-empty. There is no omission default — a request that does not state its authority is a 400, so no caller is handed the broadest scope set by accident. autopilot:history is absent by design: it is the Autopilot worker capability and this route refuses it with a 400.

originsstring[]

Optional origin allowlist (e.g. ["http://localhost:3000"])

Response

Token created (raw token returned once)

idstring required
labelstring required
tokenstring required

Raw token (shown once). Format: tp_<64 lowercase hex> (67 chars total).

originsstring[] nullable
createdAtstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.