---
title: "Create an Auth Token"
method: POST
path: "/v3/user/tokens"
tags: ["authentication"]
---

# Create an Auth Token

`POST /v3/user/tokens`

## Request

- Base URL: `https://api.vercel.com`
- URL: `https://api.vercel.com/v3/user/tokens`
- Auth: HTTP bearer

Creates and returns a new authentication token for the currently authenticated User. The `bearerToken` property is only provided once, in the response body, so be sure to save it on the client for use with API requests.

## Query parameters

- `teamId` string
- `slug` string

## Request body

- object
  - `name` string, required
  - `expiresAt` number
  - `projectId` string: The ID of the project to scope this token to

## Response `200`

Successful response.

- object: Successful response.
  - `bearerToken` string, required: The authentication token's actual value. This token is only provided in this response, and can never be retrieved again in the future. Be sure to save it somewhere safe!
  - `token` AuthToken, required: Authentication token metadata.
    - `activeAt` number, required: Timestamp (in milliseconds) of when the token was most recently used.
    - `createdAt` number, required: Timestamp (in milliseconds) of when the token was created.
    - `expiresAt` number: Timestamp (in milliseconds) of when the token expires.
    - `id` string, required: The unique identifier of the token.
    - `leakedAt` number: Timestamp (in milliseconds) of when the token was marked as leaked.
    - `leakedUrl` string: URL where the token was discovered as leaked.
    - `name` string, required: The human-readable name of the token.
    - `origin` string: The origin of how the token was created.
    - `prefix` string: The token's prefix, for identification purposes.
    - `revokedAt` number: Timestamp (in milliseconds) of when the token was revoked.
    - `scopes` union[]: The access scopes granted to the token.
      - union
        - object: The access scopes granted to the token.
          - `createdAt` number, required
          - `expiresAt` number
          - `origin` 'app' | 'apple' | 'bitbucket' | 'chatgpt' | 'email' | 'emu' | 'github' | 'github-webhook' | 'gitlab' | 'google' | 'invite' | 'manual' | 'otp' | 'passkey' | 'saml' | 'sms' | 'token-exchange-oidc'
          - `sudo` object
            - `expiresAt` number, required
            - `origin` 'email-otp' | 'otp' | 'recovery-code' | 'totp' | 'webauthn', required: Possible step-up auth origins
            - `verifiedAt` number
          - `type` 'user', required
        - object: The access scopes granted to the token.
          - `createdAt` number, required
          - `expiresAt` number
          - `origin` 'app' | 'apple' | 'bitbucket' | 'chatgpt' | 'email' | 'emu' | 'github' | 'github-webhook' | 'gitlab' | 'google' | 'invite' | 'manual' | 'otp' | 'passkey' | 'saml' | 'sms' | 'token-exchange-oidc'
          - `teamId` string, required
          - `type` 'team', required
    - `suffix` string: The last few characters of the token, for identification purposes.
    - `type` string, required: The type of the token.

## Other responses

- `400`: One of the provided values in the request body is invalid.
- `401`: The request is not authorized.
- `403`: You do not have permission to access this resource.
- `404`
- `410`

## Changes

- **2026-07-31** `e20468c66692`: 1 info
  - added the new optional request property `projectId`
- **2026-07-21** `2ae10ee9d21c`: 1 info
  - added the non-success response with the status `410`
- **2026-06-11** `14b4658f819e`: 1 breaking, 4 info
  - added `subschema #1, subschema #2` to the `token/scopes/items/` response property `oneOf` list for the response status `200`
  - added the non-success response with the status `404`
  - added the optional property `token/prefix` to the response with the `200` status
  - added the optional property `token/revokedAt` to the response with the `200` status
  - …1 more
- **2026-02-10** `486a07653d6e`: 1 breaking, 3 info
  - added `subschema #1, subschema #2` to the `token/scopes/items/` response property `oneOf` list for the response status `200`
  - added the optional property `token/leakedUrl` to the response with the `200` status
  - added the optional property `token/suffix` to the response with the `200` status
  - removed `subschema #1, subschema #2` from the `token/scopes/items/` response property `oneOf` list for the response status `200`
- **2026-01-22** `c12186034433`: 1 breaking, 1 info
  - request body became required
  - added the optional property `token/leakedAt` to the response with the `200` status

[Operation history](https://skmtc.dev/vercel/apis/vercel-api/changes/v3/user/tokens/post.md)

---

[API](https://skmtc.dev/vercel/apis/vercel-api.md) - [All operations](https://skmtc.dev/vercel/apis/vercel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vercel/apis/vercel-api/revisions/60686c0e1f6a?raw)