---
title: "Create a short-lived token for a Space's REST API"
method: POST
path: "/v1/spaces/{spaceId}/zero/token"
tags: ["Spaces"]
---

# Create a short-lived token for a Space's REST API

`POST /v1/spaces/{spaceId}/zero/token`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/zero/token`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://api.spacefast.com/v1/auth/oauth2/authorize`, token URL `https://api.spacefast.com/v1/auth/oauth2/token`; client credentials, token URL `https://api.spacefast.com/v1/auth/oauth2/token`, scopes: `spaces:write`)

Returns a bearer token, valid for `ttlSeconds`, for calling this Space's own WordPress REST API with the access of one of its machine credentials (`credentialId`). Authenticate normally; you never need that credential's secret. Send the token only to the returned `endpoint`, and keep it out of logs and chat. The Space re-checks the credential's Grant on every request, so the returned capabilities and role are what to expect, not a promise.

## Path parameters

- `spaceId` string, required

## Request body

- object
  - `credentialId` string, required: A live machine credential of this Space. Its canonical scoped Grant is the authority the Space's own runtime re-derives the WordPress role from.
  - `ttlSeconds` integer: How long the bearer stays valid, in seconds.

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object, required
    - `token` string, required: Send as `X-SF-Authorization: Bearer <token>` to the Space's own REST surface — the plain Authorization header belongs to the customer's application and passes through untouched.
    - `expiresAt` string, date-time, required
    - `host` string, required: The serving host this bearer is bound to.
    - `endpoint` string, uri, required: The Space's WordPress REST root.
    - `credentialId` string, required
    - `capabilities` string[], required
    - `role` 'subscriber' | 'editor' | 'administrator', nullable, required: The WordPress role those capabilities project to, or null when the request would reach WordPress as nobody.

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)