API tokens

Create an API token for the active account

The response is the only time the plaintext token is returned. Requires a browser session — API tokens cannot manage tokens.

post/account/api-tokens

Request

Base URL: https://api.nippy.host
URL: https://api.nippy.host/account/api-tokens
Auth: bearer (a scheme the document does not define)

Request body

namestring required

Display name identifying where the token is used

scopesstring[] required

Scopes the token may exercise

expiresAtstring

Optional ISO-8601 expiry. Omitted (the default) means the token lives until revoked.

refstring

Creation channel for attribution (e.g. "cli" when the tokens page was deep-linked from the CLI). Defaults to "web" for manual creations.

Example request

{
  "name": "Claude on my MacBook",
  "scopes": [
    "sites:read",
    "sites:deploy"
  ],
  "expiresAt": "2027-01-01T00:00:00.000Z",
  "ref": "cli"
}

Response

idstring required

Token id (use to revoke)

namestring required

Display name given at creation

displayPrefixstring required

First characters of the secret after the nippy_ prefix, for recognising a token without revealing it

scopesstring[] required

expiresAtstring date-time nullable required

revokedAtstring date-time nullable required

lastUsedAtstring date-time nullable required

Approximate (updated at most once per minute per token)

createdByUserIdstring required

User who created the token

createdAtstring date-time required

tokenstring required

The full token. Shown exactly once — store it now; only its hash is kept server-side.

Example response

{
  "displayPrefix": "ab12cd34",
  "token": "nippy_ab12cd34…"
}

Changes

No recorded changes to this operation across all 1 revision of this API.