---
title: "Create a service token"
method: POST
path: "/tokens"
tags: ["tokens"]
---

# Create a service token

`POST /tokens`

Create a service token for machine-to-machine authentication. Accepts API key or bearer token. Optionally apply restrictions.

## Request body

- CreateTokenRequest
  - `policy` Constraint[] — Constraint objects to restrict the token. Each constraint may include a `ttl` field (max 24 hours). Default TTL is 1 hour. Maximum is 24 hours.
    - `namespaces` union — Namespace(s) the token is scoped to. Accepts a single slug or an array.
      - string
      - string[]
    - `resources` union — Resource type(s) the token may access: connections, servers, namespaces, or skills.
      - 'connections' | 'servers' | 'namespaces' | 'skills'
      - string[]
    - `operations` union — Operation(s) the token may perform: read, write, or execute.
      - 'read' | 'write' | 'execute'
      - string[]
    - `metadata` union — Key-value metadata for fine-grained filtering. A single object requires all pairs to match (AND). An array of objects requires any one to match (OR-of-AND), e.g. [{"userId":"alice"},{"team":"backend"}] grants access when either condition is met.
      - object
      - object[]
    - `ttl` union — Time-to-live for the constraint. Accepts seconds (number) or a duration string such as "1h", "30m", or "20s".
      - string
      - number
    - `rpcReqMatch` object — MCP JSON-RPC request matching rules. Keys are dot-paths into the request body (e.g. "params.name", "method"). Values are regex patterns. All entries must match (AND).
  - `organizationId` string — Optional organization ID to scope the token to. When provided, the token is minted with org context. The authenticated user must be an admin or owner of the organization.

## Response `200`

Token created successfully

- CreateTokenResponse
  - `token` string, required — The signed service token.
  - `expiresAt` string, required — ISO 8601 timestamp when the token expires.

## Other responses

- `400` — Bad request (invalid parameters)
- `401` — Unauthorized (missing or invalid credentials)
- `403` — Forbidden

## Changes

- **2026-04-09** `ca0e2e65019d` — 1 info
  - added the new optional request property `organizationId`
- **2026-03-12** `8f89ae4612e1` — 1 warning
  - removed the request property `profileSlug`
- **2026-02-26** `f57cc3b6d315` — 1 info
  - added the new optional request property `policy/items/rpcReqMatch`
- **2026-02-02** `6547bf9b8910` — 2 warning, 2 info
  - removed the request property `allow`
  - removed the request property `ttlSeconds`
  - added the new optional request property `policy`
  - removed the non-success response with the status `404`
- **2026-01-27** `12e546828dc5` — 1 warning, 1 info
  - removed the request property `allow/rpc`
  - added the new optional request property `allow/mcp`

[Change history](https://skmtc.dev/smithery-ai/apis/smithery-platform-api/changes/tokens/post.md)

---

[API](https://skmtc.dev/smithery-ai/apis/smithery-platform-api.md) · [All operations](https://skmtc.dev/smithery-ai/apis/smithery-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/smithery-ai/smithery-platform-api/revisions/60b8c3d2fecf/schema)