---
title: "Mint Api Credential Token"
method: POST
path: "/api-credentials/{id}/tokens"
tags: ["ApiCredentials"]
---

# Mint Api Credential Token

`POST /api-credentials/{id}/tokens`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/api-credentials/{id}/tokens`
- Auth: HTTP bearer

Mint a machine token for this credential without touching the
client_secret (the alternative to the POST /oauth/token
client_credentials exchange, which stays at 15-day tokens). The token
acts strictly for the owning entity with the credential's scopes, and
the token string appears exactly once, in this response. Lifetime is
chosen at mint: expires_in_days 30, 90 or 365 (default), or 0 for
non-expiring. Non-expiring tokens live until revoked
(DELETE /oauth-tokens/{id}) or the credential is deleted — expiry is
not the cleanup path. Rotating the secret does NOT revoke these tokens.

## Path parameters

- `id` string, required

## Request body

- ApiCredentialTokenCreateModelAttributes: Flat attributes-adapter request body (Content-Type application/json). Equivalent JSON:API shape: ApiCredentialTokenCreateModel.
  - `data` object
    - `name` string: Display label for the token ("CI server", "Zapier").
    - `expires_in_days` 30 | 90 | 365 | 0: Lifetime menu — 30, 90 or 365 days (default), or 0 for non-expiring.

## Response `201`

Minted — the token string is shown here and never again.

- MintedOauthTokenResponseAttributes
  - `data` MintedOauthTokenModelAttributes: Mint response in attributes-adapter shape (Accept application/json) — the one place the token string appears.
    - `id` string
    - `type` string
    - `token` string: The bearer token string (show-once — store it immediately).
    - `kind` 'web_or_mobile' | 'api' | 'mcp'
    - `name` string, nullable
    - `application_name` string
    - `application_uid` string
    - `scopes` string
    - `organization_id` string, uuid, nullable
    - `created_at` string, date-time
    - `expires_at` string, date-time, nullable: Null for non-expiring tokens (expires_in_days 0).
    - `current` boolean

## Other responses

- `400`: Bad Request — expires_in_days off the menu.
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/06540345bbbc?raw)