---
title: "Create a Client Token"
method: POST
path: "/client-tokens"
tags: ["clientTokens"]
---

# Create a Client Token

`POST /client-tokens`

## Request

- Base URL: `https://api.withpersona.com/api/v1`
- URL: `https://api.withpersona.com/api/v1/client-tokens`
- Auth: HTTP bearer

Creates a new client token for your organization.

## Query parameters

- `include` string
- `fields` object

## Headers

- `Key-Inflection` 'camel' | 'kebab' | 'snake'
- `Idempotency-Key` string
- `Persona-Version` '2026-09-29' | '2025-12-08' | '2025-10-27' | '2023-01-05' | '2022-09-01' | '2021-08-18' | '2021-07-05' | '2021-02-21' | '2020-05-18': Server API version. More info on versioning can be found [here](https://docs.withpersona.com/versioning).

## Request body

- object
  - `data` ClientTokensPostRequestBodyContentApplicationJsonSchemaData, required
    - `attributes` ClientTokensPostRequestBodyContentApplicationJsonSchemaDataAttributes, required
      - `name` string, required: Human-readable name of the client token
      - `api-version` string: Sentinel API version for requests made with this client token. One of `2024-08-20` or `2026-10-01`; defaults to `2024-08-20` on create.
      - `api-key-inflection` string: Default API response key inflection
      - `permissions` string[]: Abilities permitted to the client token
      - `domain-allowlist` string[]: List of allowed domains for this token
      - `allowed-resources` string[]: List of resources that this client token is authorized to manipulate
      - `version-expires-in-seconds` integer, nullable: How long newly minted client token versions live before expiring, in seconds (max 10 years). Pass null to unset.

## Response `201`

This endpoint returns a Client Token.

- ClientTokensCreateAClientTokenResponse201
  - `data` ClientToken, required: A Client Token resource
    - `type` 'client-token'
    - `id` string
    - `attributes` ClientTokenAttributes
      - `name` string: The name of the client token
      - `api-version` string, date: The Sentinel API version used by this client token. One of `2024-08-20` or `2026-10-01`.
      - `api-key-inflection` string: The key inflection used by this client token
      - `permissions` string[]: List of permissions granted to this client token
      - `domain-allowlist` string[]: List of domains allowed to use this client token
      - `allowed-resources` string[]: List of resources that this client token is authorized to manipulate
      - `version-expires-in-seconds` integer, nullable: How long newly minted client token versions live before expiring, in seconds (max 10 years). Null means new versions do not expire by default.
      - `disabled-at` string, date-time, nullable: When this client token was disabled
      - `disabled` boolean: Whether this client token is disabled
      - `created-at` string, date-time: When this client token was created
    - `relationships` ClientTokenRelationships
      - `versions` ClientTokenRelationshipsVersions
        - `data` ClientTokenRelationshipsVersionsDataItems[]
          - `type` 'client-token-version'
          - `id` string
  - `included` ClientTokenVersion[]
    - `type` 'client-token-version'
    - `id` string
    - `attributes` ClientTokenVersionAttributes
      - `value` string: The Client Token Version value, returned for a retrieved or newly created version. This should be treated with the utmost security.
      - `created-at` string, date-time: When this client token version was created
      - `expires-at` string, date-time, nullable: When this client token version expires
      - `status` string: The lifecycle status of this client token version: `active` or `disabled`.
    - `relationships` ClientTokenVersionRelationships
      - `client-token` ClientTokenVersionRelationshipsClientToken
        - `data` ClientTokenVersionRelationshipsClientTokenData
          - `type` 'client-token'
          - `id` string

## Other responses

- `400`: The request was unacceptable, often due to invalid parameters.
- `401`: An invalid API key was provided.
- `403`: The given API key doesn’t have permissions to perform the request or a quota has been exceeded.
- `409`: The request conflicts with another request, often due to attempting to create a duplicate resource.
- `422`: The request modifies the resource in an unacceptable way, often due to an invalid action or parameter.
- `429`: Your organization’s rate limit has been exceeded. We recommend an exponential backoff on requests.

---

[API](https://skmtc.dev/withpersona/apis/withpersona-4.md) - [All operations](https://skmtc.dev/withpersona/apis/withpersona-4/llms.txt) - [OpenAPI document](https://skmtc.dev/withpersona/apis/withpersona-4/revisions/2eddd7dae374?raw)