---
title: "List or create the caller's API tokens"
method: POST
path: "/api/tokens"
tags: ["Auth"]
---

# List or create the caller's API tokens

`POST /api/tokens`

## Request

- The document declares no server URL.
- Auth: none declared. Required headers: `Authorization`

GET lists the caller's tokens (token strings included for an interactive login). POST (grant token-create, interactive login only) issues a new token narrowed to a subset of the caller's own grants and a cluster scope; the token can never carry a grant the caller does not hold. The system service account can never issue tokens.

## Headers

- `Authorization` string, required

## Request body

- ServerAPITokenForm
  - `clusters` string[]: empty or ["*"] = every cluster the owner can see
  - `expireDays` integer: 0 = server default (api-user-tokens-default-expire-days); -1 = never
  - `grants` string: compact prefixes, space separated, e.g. "db-show proxy"; empty = all of the owner's grants
  - `label` string

## Response `200`

OK

- ServerAPITokenView[]
  - `clusters` string[]: cluster scope; ["*"] = all
  - `createdAt` string
  - `createdFrom` string
  - `expired` boolean
  - `expiresAt` string
  - `grants` string[]: compact grant prefixes requested by the owner
  - `id` string
  - `label` string
  - `lastUsedAt` string
  - `lastUsedFrom` string
  - `ownerAuthType` string: OwnerAuthType is how the owner was authenticated when the token was issued ("SSO" or "Local"): a token issued by a Cloud18 identity keeps that identity for the self-service rules, which need an SSO caller.
  - `revoked` boolean
  - `revokedAt` string
  - `revokedBy` string
  - `token` string
  - `user` string

## Other responses

- `400`: Bad request
- `403`: Forbidden

## Changes

- **2026-10-05** `1bf429f49b60`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/signal18/apis/signal-18-dashboard-api/changes/api/tokens/post.md)

---

[API](https://skmtc.dev/signal18/apis/signal-18-dashboard-api.md) - [All operations](https://skmtc.dev/signal18/apis/signal-18-dashboard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/signal18/apis/signal-18-dashboard-api/revisions/8ee8a1e31294?raw)