---
title: "Create an API token"
method: POST
path: "/tokens"
tags: ["API tokens"]
---

# Create an API token

`POST /tokens`

## Request

- Base URL: `https://tasg.app/api/v1`
- URL: `https://tasg.app/api/v1/tokens`
- Auth: HTTP bearer

The plaintext (`plain`, prefixed `tf_`) is returned once; store it. Default scopes are `read` + `write`. A token may not mint a token with scopes beyond its own. Max 10 per user.

## Request body

- object
  - `name` string, required
  - `scopes` TokenScope[]: Default `["read","write"]`.

## Response `201`

Created.

- object
  - `token` object, required: Personal API token metadata (camelCase keys). The secret is never returned after creation.
    - `id` string, uuid, required
    - `name` string, required
    - `scopes` TokenScope[], required
    - `lastUsedAt` string, date-time, nullable
    - `createdAt` string, date-time, required
    - `plain` string, required: The secret. Shown once.

## Other responses

- `400`: Validation failed: the body or query did not match the schema, or a business rule was violated. `error` says which.
- `401`: Missing, invalid, expired or revoked credentials.
- `403`: Authenticated, but not allowed: not a member, insufficient project role or the API token lacks the required scope.
- `429`: Rate limited. Back off and retry after the window in the `RateLimit-*` headers.

---

[API](https://skmtc.dev/tasg/apis/tasg-api.md) · [All operations](https://skmtc.dev/tasg/apis/tasg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tasg/apis/tasg-api/revisions/cd2a1dbaf5cf?raw)