---
title: "Mint an MCP Personal Access Token for a workspace"
method: POST
path: "/api/workspaces/{wid}/mcp/pats"
tags: ["MCP PATs"]
---

# Mint an MCP Personal Access Token for a workspace

`POST /api/workspaces/{wid}/mcp/pats`

Returns the secret ONCE in the response body. At least one scope must be provided. The PAT is bound to the URL's workspace; the body has no workspace field.

## Path parameters

- `wid` string, required

## Request body

- MCPPATMintRequest
  - `expires_at` string
  - `name` string, required
  - `scopes` string[], required

## Response `201`

Created

- MCPPATMintResponse
  - `created_at` string, required
  - `expires_at` string, required
  - `id` string, required
  - `name` string, required
  - `prefix` string, required
  - `scopes` string[], required
  - `secret` string, required
  - `workspace_id` string, required

## Other responses

- `400` — name required / scope not available
- `401` — not authenticated
- `404` — not found (or not a member of the workspace)
- `422` — expires_at invalid
- `500` — internal error

---

[API](https://skmtc.net/agentserver/apis/agentserver-api.md) · [All operations](https://skmtc.net/agentserver/apis/agentserver-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/agentserver/agentserver-api/versions/e8c329825b4e/schema)