---
title: "Create Expiring Access Token"
method: POST
path: "/expiring_token"
tags: ["Expiring Access Tokens"]
---

# Create Expiring Access Token

`POST /expiring_token`

## Request

- Base URL: `https://api.wistia.com/modern`
- URL: `https://api.wistia.com/modern/expiring_token`
- Auth: HTTP bearer

```
🚫 Alert
This API is still under development and can change at any time.
```

This endpoint is for creating expiring access tokens which can be used for some iframe embeds
and, when granted the `all:delegate_to_contact_permissions` scope, for REST API requests
authorized by the token's authorizations.

## Requires api token with one of the following permissions
```
Read, update & delete anything
```

Tokens with the "Act with a team member's permissions" permission
(`all:delegate_to_contact_permissions` scope) can also be used. Requests
made with such a token are authorized using the permissions of the
contact assigned to the token.

## Headers

- `X-Wistia-API-Version` string, required

## Request body

- object
  - `expiring_access_token` object
    - `expires_at` string, iso8601: an ISO8601 string of when the token will expire, defaults to two days from creation
    - `scopes` string[]: The scopes the token will be granted. `graphql:all` allows GraphQL requests (e.g. the embedded transcript editor) and `all:delegate_to_contact_permissions` allows REST API requests authorized by the token's authorizations. Defaults to `["graphql:all"]` when omitted.
    - `authorizations` object[]: The rules the token carries. Each rule names one object by `type` and `id` and lists the `permissions` granted on it. Any permission implicitly allows viewing the object; every other permission must be declared explicitly.
      - `type` 'media' | 'folder' | 'account' | 'webinar' | 'channel' | 'review-bundle' | 'brand', required: The type of object the rule names.
      - `id` string, required: The id of the object the rule names: its hashed id, except for an `account`, which uses its numeric `id` (as returned by `GET /modern/account`) and must be the token's own account.
      - `permissions` string[], required: The permissions granted on the object, by type: - `media`: `show`, `update`, `destroy`, `edit-transcripts`, `view-stats`, `edit`, `share`, `translate`, `order-audio-descriptions`, `create-transcripts`. `edit` allows changing the media's player customizations. `edit-transcripts` also lists and shows the media's localizations, and deletes them together with `update`; no other permission reaches a media's localizations. `translate` orders localizations (dubs). Any permission lists and shows the media's extended audio descriptions, `update` deletes them and `order-audio-descriptions` orders one. `edit-transcripts` is the only permission that also reaches the media's captions and speaker data; `show`, `update` and `destroy` apply to the media itself and never to those nested resources. `create-transcripts` allows uploading and purchasing captions for the media without reading or editing existing ones. `share` allows adding the media to a new review bundle. - `folder`: `show`, `update`, `destroy`, `upload`, `share`, `view-stats`. A rule also covers the folder's subfolders: any permission lists and shows them, and `update` creates, renames and deletes them. It also covers the folder's sharings: any permission lists and shows them, `share` creates them, and `update` edits and deletes them. `upload` also allows restoring deleted media into the folder. - `account`: `create-folders`, `create-channels`, `create-webinars`, `view-stats`, `manage-team`, `view-speakers`, `view-tags`, `manage-tags`, `manage-allowed-domains`, `manage-deleted-media`, `create-brands`, `manage-brand-preload`. `manage-team` allows inviting contacts to the account. `view-speakers` lists the account's speaker profiles. `view-tags` lists the account's tags, and `manage-tags` also creates and deletes them. `manage-allowed-domains` lists, shows, adds and deletes the account's allowed domains; without it a token sees none. `manage-deleted-media` allows listing and restoring the deleted media the token's media rules name. `create-brands` allows creating brands, and `manage-brand-preload` allows updating the brand preload. - `webinar`: `show`, `update`, `destroy`, `view-stats`. A rule also covers the webinar's registrations and collaborators: any permission lists its registrations, and `update` registers attendees and lists, invites and removes collaborators. - `channel`: `show`, `update`, `destroy`. A rule also covers the channel's episodes and collaborators: any permission lists and shows its episodes, and `update` adds, edits, publishes, unpublishes and removes episodes and lists, invites and removes collaborators. - `review-bundle`: `show`, `destroy`. Creating a review bundle needs no rule on a review bundle; it needs `share` on every media in it. - `brand`: `show`, `update`, `destroy`. Applying the brand to a media, folder or channel takes `update` on the brand and an `update` rule naming that media, folder or channel.

## Response `200`

Successful response

- object
  - `token` string, required: A token which can be used to authorize requests to Wistia. With the `graphql:all` scope it authorizes GraphQL requests such as transcript embeds; with the `all:delegate_to_contact_permissions` scope it can also be used as a bearer token for REST API requests authorized by the token's authorizations.

## Other responses

- `401`: Unauthorized, invalid or missing token
- `422`: Unprocessable entity, the request parameters were invalid.
- `500`: Internal server error
- `501`: Not implemented - expiring tokens cannot be created from other expiring tokens

## Changes

- **2026-11-03** `b86cb2a7b420`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/wistia/apis/data-api/changes/expiring_token/post.md)

---

[API](https://skmtc.dev/wistia/apis/data-api.md) - [All operations](https://skmtc.dev/wistia/apis/data-api/llms.txt) - [OpenAPI document](https://skmtc.dev/wistia/apis/data-api/revisions/b86cb2a7b420?raw)