---
title: "Create new access token"
method: POST
path: "/access_token"
tags: ["Users"]
---

# Create new access token

`POST /access_token`

## Request body

- AccessTokenCreateRequestBody — AccessTokenCreateRequestBody
  - `description` string, required — Name / description of an access token
  - `extend_when_used` boolean — Extend token expiration time when token is used. Only applicable if max_age_seconds is specified.
  - `ip_allowlist` string[] — List of allowed IP ranges
  - `max_age_seconds` number — Time the token remains valid since creation (or since last use if extend_when_used is true)
  - `scopes` string[] — Scopes this token is restricted to, if specified

## Response `200`

Response

- AccessTokenCreateResponse — AccessTokenCreateResponse
  - `create_time` string, required — Timestamp when the access token was created
  - `created_manually` boolean, required — True for tokens explicitly created via the access_tokens API, false for tokens created via login.
  - `currently_active` boolean — true if API request was made with this access token
  - `description` string — Name / description of an access token
  - `errors` object[] — List of errors occurred during request processing
    - `message` string, required — Printable error message
    - `more_info` string — URL to the documentation of the error
    - `status` integer, required — HTTP error status code
  - `expiry_time` string — Timestamp when the access token will expire unless extended, if ever
  - `extend_when_used` boolean, required — Extend token expiration time when token is used. Only applicable if max_age_seconds is specified.
  - `full_token` string, required — This full access token can be used to make API calls. This can also be used to update or revoke tokens. Note that when using this token with the update and revoke APIs it must be URL encoded because it may contain /, + and = characters (/ => %2F, + => %2B, = => %3D).
  - `ip_allowlist` string[] — List of allowed IP ranges
  - `last_ip` string — IP address the access token was last used from in case it has ever been used
  - `last_used_time` string — Timestamp when the access token was last used, if ever
  - `last_user_agent` string — User agent string of the client that last used the token in case it has ever been used
  - `last_user_agent_human_readable` string — Human readable user agent string of the client that last used the token in case user agent is known
  - `max_age_seconds` number, required — Time the token remains valid since creation (or since last use if extend_when_used is true)
  - `message` string — Printable result of the request
  - `scopes` string[] — Scopes this token is restricted to, if specified
  - `token_prefix` string, required — First characters of the actual token value. Full value is only exposed after creation. This value is used when updating or revoking tokens. Note that the value may contain /, + and = characters and must be URL encoded when used (/ => %2F, + => %2B, = => %3D).

---

[API](https://skmtc.net/aiven/apis/aiven-api-documentation.md) · [All operations](https://skmtc.net/aiven/apis/aiven-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aiven/aiven-api-documentation/revisions/cbfbf0f96a48/schema)