---
title: "Create a service account token"
method: POST
path: "/api/v3/workspaces/{workspace}/service-account-tokens"
tags: ["Service Account Tokens"]
---

# Create a service account token

`POST /api/v3/workspaces/{workspace}/service-account-tokens`

Create a dedicated service-account user scoped to this workspace and return a JWT (`token` field) usable as `Authorization: Bearer <token>` on PAPI and AgentFarm. The full token is returned once — store it securely. Caller must be a workspace **admin**.

## Path parameters

- `workspace` string, required

## Request body

- ServiceAccountTokenCreate — Create a token scoped to the workspace in the URL path.
  - `name` string, required — Human-readable label for the token
  - `role` 'admin' | 'readwrite' | 'readandrun' | 'readandrunwithassistant' | 'readonly' — Workspace permission role granted to the token
  - `expiresInDays` integer, nullable — Token lifetime in days. Omit for the platform default (~10 years).

## Response `201`

Token created (includes one-time JWT)

- ServiceAccountTokenCreateResponse — Metadata for an admin-managed service account token (JWT secret is never returned again after create).
  - `id` string, uuid
  - `name` string
  - `tokenSuffix` string — Last 8 characters of the JWT for identification
  - `createdByName` string, nullable
  - `expiresAt` string, date-time, nullable
  - `isRevoked` boolean
  - `isExpired` boolean
  - `isActive` boolean
  - `lastUsedAt` string, date-time, nullable
  - `createdAt` string, date-time
  - `scopes` ServiceAccountTokenScope[]
    - `id` integer
    - `workspaceId` integer
    - `workspaceName` string
    - `role` string
  - `token` string, required — Full JWT access token — shown once at creation; store securely.

## Other responses

- `403` — Admin permission required
- `404` — Workspace not found

---

[API](https://skmtc.dev/runwhen/apis/runwhen-platform-api.md) · [All operations](https://skmtc.dev/runwhen/apis/runwhen-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/runwhen/runwhen-platform-api/revisions/9d1a64d4b1c1/schema)