---
title: "Issue a personal access token"
method: POST
path: "/access-tokens"
tags: ["Account"]
---

# Issue a personal access token

`POST /access-tokens`

## Request

- Base URL: `https://whatareyoudo.ing/api/v1`
- URL: `https://whatareyoudo.ing/api/v1/access-tokens`
- Auth: HTTP bearer

The response carries the token itself, and it is the only place it ever exists -- only a hash is stored. Send it as `Authorization: Bearer whatcha_pat_...`. Requires a session: a token cannot issue a token.

## Request body

- IssueAccessTokenRequest
  - `name` string, required
  - `scope` 'read' | 'write'
  - `expiresInDays` integer

## Response `201`

Issued

- object
  - `data` IssuedAccessToken, required
    - `id` string, uuid, required
    - `name` string, required
    - `scope` 'read' | 'write', required
    - `tokenId` string, required
    - `createdAt` string, required
    - `expiresAt` string, required
    - `lastUsedAt` string, nullable, required
    - `oauthClient` object, nullable, required
      - `name` string, required
    - `refreshExpiresAt` string, nullable, required
    - `token` string, required
  - `meta` object, required
    - `requestId` string, required

## Other responses

- `403`: The caller is itself an access token
- `422`: Invalid name or expiry, or the per-account limit is reached

---

[API](https://skmtc.dev/whatareyoudo/apis/whatcha-api.md) · [All operations](https://skmtc.dev/whatareyoudo/apis/whatcha-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whatareyoudo/apis/whatcha-api/revisions/48dd8a54abea?raw)