---
title: "Create API Token"
method: POST
path: "/v1/auth/api-tokens/{tokenName}"
---

# Create API Token

`POST /v1/auth/api-tokens/{tokenName}`

Returns a new API token belonging to a user.

The token can be minted at three levels of restriction, in increasing order of narrowness:

- **Organization-scoped** — pass `organization`. The token can only act on resources inside that organization.
- **Group-scoped** — pass `organization`, `group`, and `scopes`. The token is pinned to a single group inside the organization and only the operations listed in `scopes` are allowed. The caller must be an admin or owner of the organization.
- **Unrestricted** *(deprecated)* — no request body. The token can act on every organization the caller belongs to. **Unrestricted tokens are deprecated and will be removed in a future release.** Always pass `organization` for new tokens and rotate existing unrestricted tokens to scoped tokens.

Group-scoped tokens are designed for automations that should be able to provision and manage databases inside a single group without being able to touch the rest of the organization.

## Path parameters

- `tokenName` string, required

## Request body

- object
  - `organization` string — The organization slug to restrict this token to. Required when `group` is set.
  - `group` string — The group name (inside `organization`) to restrict this token to. Requires `organization` and a non-empty `scopes` list.
  - `scopes` string[] — Permissions to grant a group-scoped token. Each entry is either an individual scope or one of the presets `read-only` (expands to `read`) and `full-access` (expands to every scope). Required and must be non-empty when `group` is set. `db:mint-token` lets the token issue new SQL credentials; `db:rotate-creds` invalidates every existing SQL token for the database — they are deliberately separate because rotation is destructive.

## Response `200`

Successful response

- object
  - `name` Name — unresolved $ref
  - `id` Id — unresolved $ref
  - `token` string — The actual token contents as a JWT. This is used with the `Bearer` header, see [Authentication](/authentication) for more details. **This token is never revealed again.**

---

[API](https://skmtc.dev/turso/apis/turso-platform-api.md) · [All operations](https://skmtc.dev/turso/apis/turso-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/turso/turso-platform-api/revisions/6c99e4c88978/schema)