---
title: "Create a personal access token (session-only)"
method: POST
path: "/api/tokens"
---

# Create a personal access token (session-only)

`POST /api/tokens`

## Request

- Base URL: `https://whenmeet.me`
- URL: `https://whenmeet.me/api/tokens`
- Auth: API key in cookie `__Host-session`

Requires a browser session — a token cannot mint more tokens. The plaintext token is returned exactly once.

## Request body

- object
  - `name` string
  - `scopes` string[]: Default ["read","write"]; "write" implies "read".
  - `expiresInDays` 30 | 90 | 365 | null, nullable: Default 90; null = never expires.

## Response `200`

{ id, name, token, scopes, expiresAt } — store the token now.

## Other responses

- `400`: invalid_scopes | invalid_expiry | too_many_tokens

---

[API](https://skmtc.dev/whenmeet/apis/whenmeet-me-api.md) · [All operations](https://skmtc.dev/whenmeet/apis/whenmeet-me-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whenmeet/apis/whenmeet-me-api/revisions/202b80022215?raw)