---
title: "Create a developer token (all tiers; requires the tokensManage scope)"
method: POST
path: "/v1/tokens"
tags: ["Tokens"]
---

# Create a developer token (all tiers; requires the tokensManage scope)

`POST /v1/tokens`

## Request

- Base URL: `http://localhost:9998`
- URL: `http://localhost:9998/v1/tokens`
- Auth: HTTP bearer

Creates a persistent Bearer token for API access. The raw token is returned
only once in the response — store it securely. Available on every tier — token
management is a security primitive, not a paid feature. Requires a bearer with
the `tokensManage` scope and every requested scope. A caller cannot mint
authority it does not hold. This is scope enforcement, never a subscription
tier requirement.

## Request body

- object
  - `label` string: Human-readable label for the token
  - `scopes` string[], required: Required, non-empty. There is no omission default — a request that does not state its authority is a 400, so no caller is handed the broadest scope set by accident. `autopilot:history` is absent by design: it is the Autopilot worker capability and this route refuses it with a 400.
  - `origins` string[]: Optional origin allowlist (e.g. ["http://localhost:3000"])

## Response `201`

Token created (raw token returned once)

- DevTokenCreated
  - `id` string, required
  - `label` string, required
  - `token` string, required: Raw token (shown once). Format: `tp_<64 lowercase hex>` (67 chars total).
  - `origins` string[], nullable
  - `createdAt` string, date-time, required

## Other responses

- `403`: Bearer missing `tokensManage` or a requested scope

---

[API](https://skmtc.dev/modelpiper/apis/toolpiper-api.md) · [All operations](https://skmtc.dev/modelpiper/apis/toolpiper-api/llms.txt) · [OpenAPI document](https://skmtc.dev/modelpiper/apis/toolpiper-api/revisions/6722bf56385c?raw)