---
title: "Create a scoped access token"
method: POST
path: "/api/ee/scoped_access_token"
tags: ["Scoped Access Tokens"]
---

# Create a scoped access token

`POST /api/ee/scoped_access_token`

## Request

- The document declares no server URL.
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Sourcebot-Api-Key`

Creates an opaque bearer token that expires exactly one hour after issuance and is restricted to the requested repositories.

## Request body

- PublicCreateScopedAccessTokenRequest
  - `repoIds` integer[], required: Repository IDs to bind to the token. Every ID must identify a repository accessible to the API-key owner.

## Response `201`

Scoped access token created. The opaque token value is returned only in this response.

- PublicCreateScopedAccessTokenResponse
  - `id` string, required: Identifier used to revoke the token.
  - `token` string, required: Opaque bearer token. This value is returned only when the token is created.
  - `createdAt` string, date-time, required
  - `expiresAt` string, date-time, required
  - `repoIds` integer[], required

## Other responses

- `400`: Invalid request body or repository scope.
- `401`: Missing or invalid authentication.
- `403`: The current authentication method is not an API key, or the API-key owner is not permitted to perform this operation.
- `500`: Unexpected token creation failure.

## Changes

- **2026-11-03** `cd10497219e1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/sourcebot/apis/sourcebot-public-api/changes/api/ee/scoped_access_token/post.md)

---

[API](https://skmtc.dev/sourcebot/apis/sourcebot-public-api.md) - [All operations](https://skmtc.dev/sourcebot/apis/sourcebot-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sourcebot/apis/sourcebot-public-api/revisions/cd10497219e1?raw)