---
title: "Create a personal access token for the authenticated user"
method: POST
path: "/personal-access-tokens"
tags: ["Users"]
---

# Create a personal access token for the authenticated user

`POST /personal-access-tokens`

Issues a new personal-access token for the currently
authenticated user. The raw token value is included in the
response; subsequent reads will only expose the metadata.
Treat the response as sensitive.

## Request body

- PersonalAccessToken — A named personal-access token issued to a user, used to authenticate API calls in place of a username and password. The raw token value is only ever returned at the moment of creation via `createPersonalAccessToken`; subsequent reads expose only the token's metadata.
  - `id` string — Stable identifier for the personal-access token. Use this to revoke the token later via `deletePersonalAccessToken`. The ID is safe to log; the raw secret is only ever returned at creation as `accessToken`.
  - `name` string, required — A human-readable label for the token, used to distinguish it from other tokens issued to the same user.
  - `created_at` string, date-time — The date and time the personal access token was created.

## Response `200`

A newly issued personal access token

- object
  - `token` PersonalAccessToken, required — A named personal-access token issued to a user, used to authenticate API calls in place of a username and password. The raw token value is only ever returned at the moment of creation via `createPersonalAccessToken`; subsequent reads expose only the token's metadata.
    - `id` string — Stable identifier for the personal-access token. Use this to revoke the token later via `deletePersonalAccessToken`. The ID is safe to log; the raw secret is only ever returned at creation as `accessToken`.
    - `name` string, required — A human-readable label for the token, used to distinguish it from other tokens issued to the same user.
    - `created_at` string, date-time — The date and time the personal access token was created.
  - `accessToken` string, required — The raw access token. This is the only time the raw value is returned — store it securely.

## Other responses

- `401` — The user is unauthenticated
- `403` — The authenticated user does not have permission.
- `422` — The request didn't pass validation

---

[API](https://skmtc.dev/try/apis/trybe-api.md) · [All operations](https://skmtc.dev/try/apis/trybe-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/try/trybe-api/revisions/f37f92702da5/schema)