Mints a new personal access token for the caller. Deliberately not admin-gated — any authenticated org member may create their own, unlike OAuth app registration.

The token is minted against a lazily-created, per-org synthetic OAuth app (clientId: pat-system:<orgId>) shared by every PAT in that org — the same signing, hashing, and revocation machinery as /oauth2/token, reused rather than duplicated.

scopes is validated against the org's configured MCP_SCOPES env var, not the full role-aware OAuth-app scope catalog — a non-admin can request any scope in that set.

Session only. The bearer token must be the user's interactive session JWT. OAuth access tokens and personal access tokens (phpat_...) are rejected with 403, so a token that is already issued cannot mint another with wider scopes or a longer life.

The response's accessToken is shown once; only its SHA-256 hash is stored. It's prefixed phpat_ (see the bearerAuth security scheme).

{
  "name": "Claude Desktop",
  "scopes": [
    "kb:read",
    "semantic:write"
  ]
}

{
  "message": "Personal access token created successfully",
  "token": {
    "accessToken": "phpat_eyJhbGciOiJIUzI1NiIs..."
  }
}