---
title: "Issues a namespace-scoped JWT. Requires the admin token, even when the deployment allows unauthenticated requests."
method: POST
path: "/auth/tokens"
tags: ["auth::tokens"]
---

# Issues a namespace-scoped JWT. Requires the admin token, even when the deployment allows unauthenticated requests.

`POST /auth/tokens`

## Request

- Base URL: `https://api.rivet.dev`
- URL: `https://api.rivet.dev/auth/tokens`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-rivet-token`

## Request body

- AuthTokenCreateRequest
  - `namespace` string, required: Name of the namespace the token is scoped to. It must exist.
  - `duration` integer, nullable: Token lifetime in seconds, from 1 to the deployment's maximum. Defaults to the deployment's configured duration.
  - `subject` string, nullable: Opaque identifier of the end user, at most 256 UTF-8 bytes. Only used for correlation.
  - `grants` AuthTokenGrant[], required: Access the token carries within its namespace.
    - `resource` 'namespace' | 'actor' | 'node' | 'pool' | 'datacenter' | 'actor_gateway' | 'actor_kv', required: Resource type a grant applies to.
    - `target` union, required: `"any"` for every resource of the type, or `{ "id": "..." }` for one resource.
      - 'any'
      - object
        - `id` string, required: A Rivet ID: 30 lowercase base36 characters.
    - `operations` AuthOperationKind[], required: Operations the grant allows on the target.

## Response `200`

The issued token. The response carries `Cache-Control: no-store`.

- AuthTokenCreateResponse
  - `token` string, required: The signed JWT.
  - `issued_ts` integer, required: When the token was issued, in Unix milliseconds.
  - `expires_ts` integer, required: When the token expires, in Unix milliseconds.

## Other responses

- `400`: `validation.invalid_input`: the subject exceeds 256 UTF-8 bytes, the duration is outside the allowed range, or the grant set is invalid (empty, more than 32 grants, a grant without operations or with more than 5, or a `token` or `jwt` resource). `envoy.invalid_namespace_name`: the `namespace` value is not a DNS label of 1 to 63 lowercase letters, digits and hyphens.
- `401`: `auth.invalid_token`: the request does not carry the admin token.
- `403`: `auth.issuance_disabled`: JWT issuance is not enabled for this deployment.
- `404`: `namespace.not_found`: the namespace does not exist.
- `415`: The request is missing the `Content-Type: application/json` header. Returned as plain text.
- `422`: The JSON body does not match the request schema, for example a missing required field, a wrong type or an unknown field where unknown fields are rejected. Returned as plain text.
- `500`: `core.internal_error`: an unexpected failure, including a deployment without authentication configured.
- `503`: `auth.issuance_unavailable`: the signing service is temporarily unavailable. Retry the request.

## Changes

- **2026-10-31** `aa8d1a8a5d14`: 6 breaking, 11 info
  - removed the enum value `runner` of the request property `grants/items/resource`
  - removed the enum value `runner_config` of the request property `grants/items/resource`
  - the `duration` request property's min was increased to `1.00`
  - the `grants` request property's minItems was increased to `1`
  - …13 more
- **2026-09-23** `cf75c79633e3`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/rivet-dev/apis/rivet-api-public/changes/auth/tokens/post.md)

---

[API](https://skmtc.dev/rivet-dev/apis/rivet-api-public.md) - [All operations](https://skmtc.dev/rivet-dev/apis/rivet-api-public/llms.txt) - [OpenAPI document](https://skmtc.dev/rivet-dev/apis/rivet-api-public/revisions/531e21275aec?raw)