---
title: "Create access token"
method: POST
path: "/access_tokens"
tags: ["Access tokens"]
---

# Create access token

`POST /access_tokens`

Create a short-lived access token for authenticating API requests. When using API key authentication, provide account_id or user_id. When using OAuth, the user is derived from the token. Use this token with Whop's web and mobile embedded components.

## Request body

- object — Parameters for CreateAccessToken
  - `account_id` string, nullable — The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company.
  - `expires_at` string, date-time, nullable — The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours.
  - `scoped_actions` string[], nullable — An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions.
  - `user_id` string, nullable — The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user.

## Response `200`

A successful response

- AccessToken — A short-lived access token used to authenticate API requests on behalf of a user.
  - `expires_at` string, date-time, required — The timestamp after which this access token is no longer valid and must be refreshed.
  - `token` string, required — The signed JWT access token string to include in API request Authorization headers.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `422` — Verification required
- `429` — Too many requests
- `500` — Internal server error

## Changes

> 61 revisions in range; 1 not diffed.

- **2026-09-03** `697924df40d1` — 1 warning, 1 info
  - removed the request property `company_id`
  - added the new optional request property `account_id`

[Change history](https://skmtc.dev/whop/apis/whop-api/changes/access_tokens/post.md)

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whop/apis/whop-api/revisions/ef86d14ef691?raw)