---
title: "Create an API token"
method: POST
path: "/tokens"
tags: ["API tokens"]
---

# Create an API token

`POST /tokens`

## Request

- Base URL: `https://api.rightmessage.com/v1`
- URL: `https://api.rightmessage.com/v1/tokens`
- Auth: HTTP bearer

Creates an API token for the authenticated user. `abilities` may contain `read`, `write`, `publish` or `*`; omit it to grant `*` (every ability). The `plainTextToken` is returned only in this response. Requires a plan with API access.

Only a signed-in dashboard session can call this; a request with an API token gets 403. It also needs a recently confirmed password and answers 423 until `POST /user/confirm-password` succeeds.

## Request body

- object
  - `name` string, required
  - `abilities` string[]

## Response `201`

- object
  - `data` object, required
    - `id` string, required
    - `name` string, required
    - `abilities` string, required
    - `plainTextToken` string, required

## Other responses

- `401`: Missing, invalid or revoked API token.
- `403`: An error
- `422`: Validation error
- `429`: Rate limit exceeded: 120 requests per minute for project endpoints, 60 per minute for token and connection endpoints. Retry after the `Retry-After` seconds.

---

[API](https://skmtc.dev/rightmessage/apis/rightmessage-api.md) - [All operations](https://skmtc.dev/rightmessage/apis/rightmessage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rightmessage/apis/rightmessage-api/revisions/adec35e9720c?raw)