---
title: "Create an API token for the active account"
method: POST
path: "/account/api-tokens"
tags: ["API tokens"]
---

# Create an API token for the active account

`POST /account/api-tokens`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/account/api-tokens`
- Auth: `bearer` (a scheme the document does not define)

The response is the only time the plaintext token is returned. Requires a browser session — API tokens cannot manage tokens.

## Request body

- CreateApiTokenDto
  - `name` string, required: Display name identifying where the token is used
  - `scopes` string[], required: Scopes the token may exercise
  - `expiresAt` string: Optional ISO-8601 expiry. Omitted (the default) means the token lives until revoked.
  - `ref` string: Creation channel for attribution (e.g. "cli" when the tokens page was deep-linked from the CLI). Defaults to "web" for manual creations.

## Response `201`

- APICreatedApiToken
  - `id` string, required: Token id (use to revoke)
  - `name` string, required: Display name given at creation
  - `displayPrefix` string, required: First characters of the secret after the `nippy_` prefix, for recognising a token without revealing it
  - `scopes` string[], required
  - `expiresAt` string, date-time, nullable, required
  - `revokedAt` string, date-time, nullable, required
  - `lastUsedAt` string, date-time, nullable, required: Approximate (updated at most once per minute per token)
  - `createdByUserId` string, required: User who created the token
  - `createdAt` string, date-time, required
  - `token` string, required: The full token. Shown exactly once — store it now; only its hash is kept server-side.

## Other responses

- `400`: Validation failed
- `401`: Not authenticated

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)