Issue a new API token

POST

/auth/tokens

• Local development behind nginx (port 8088 by default)

Creates a Personal Access Token bound to the caller. The token value is returned in the response once and only once — it is hashed in the database and cannot be recovered later. Lose it, revoke and re-issue.

Token creation is restricted to cookie-authenticated callers, so a stolen token cannot mint further tokens.

Authorizations

• cookieAuth

Request Body ^required

object

name

required

string

>= 1 characters <= 100 characters

Example

CI deploy bot

expires_at

string format: date-time

nullable

scopes

Capability codes this token may exercise. Empty array means the token can do whatever the user can do. (Token scopes are recorded but not yet enforced.)

Array<string>

Responses

201

Token issued. The plaintext token is in the token field of the response.

object

id

required

string format: uuid

name

required

string

scopes

required

Array<string>

created_at

required

string format: date-time

expires_at

string format: date-time

nullable

last_used_at

string format: date-time

nullable

token

required

The plaintext token. Save it — it is never returned again.

string

Example

aa_pat_K7eHs0bdQ9XR8h0g7y4mR0aZ2lY1pX5N

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}