---
title: "Create a scoped API token"
method: POST
path: "/tokens"
tags: ["Authentication"]
---

# Create a scoped API token

`POST /tokens`

Optional idempotency key. Reuse the same key only for an identical request; successful responses are replayable for 24 hours.

## Headers

- `Idempotency-Key` string

## Response `201`

Created API token, including the one-time secret.

## Other responses

- `400` — Invalid JSON body, missing/invalid name, scopes, principalType, principalId, or expiresAt
- `403` — Admin scope required
- `409` — The key is already processing, or was reused with a different request fingerprint.
- `503` — Idempotency storage or response replay is temporarily unavailable.

## Changes

- **2026-08-31** `ef21361a36e6` — 2 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `403`
- **2026-08-25** `c3a92b6b6909` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/releases/apis/releases-api/changes/tokens/post.md)

---

[API](https://skmtc.dev/releases/apis/releases-api.md) · [All operations](https://skmtc.dev/releases/apis/releases-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/releases/releases-api/revisions/ef21361a36e6/schema)