---
title: "Create a M2M Token"
method: POST
path: "/m2m_tokens"
tags: ["M2M Tokens"]
---

# Create a M2M Token

`POST /m2m_tokens`

Creates a new M2M Token. Must be authenticated via a Machine Secret Key.

## Request body

- object
  - `token_format` 'opaque' | 'jwt'
  - `seconds_until_expiration` number, nullable
  - `claims` unknown
  - `min_remaining_ttl_seconds` integer — Enables server-side token reuse for opaque-format tokens. When set, if a non-revoked, non-expired M2M token already exists for this machine with identical `claims` and `scopes` and at least this many seconds of remaining lifetime, that existing token is returned and no new token is minted. Use this when caching tokens in application memory across requests is impractical — for example, in serverless functions, short-lived job workers, or autoscaling containers that churn faster than the token TTL. Pooling at the server collapses many redundant create calls into reuse of a single live token, which is the recommended pattern for high-volume M2M traffic. Must be strictly less than the effective token lifetime — that is, `seconds_until_expiration` when provided, or the machine's default TTL otherwise. A value greater than or equal to the lifetime is rejected with a 400, since no freshly-minted token would ever satisfy the requirement. Only applies to opaque-format tokens (`token_format` defaults to `opaque`). JWT-format tokens are stateless and are never deduplicated.

## Response `201`

201 Created

- object
  - `object` 'machine_to_machine_token', required
  - `id` string, required
  - `subject` string, required
  - `claims` unknown
  - `scopes` string[]
  - `token` string, required
  - `revoked` boolean, required
  - `revocation_reason` string, nullable, required
  - `expired` boolean, required
  - `expiration` number, nullable, required — The timestamp for when the token will expire, in milliseconds
  - `last_used_at` number, nullable, required — The timestamp for when the token was last used, in milliseconds
  - `created_at` number, required — The timestamp for when the token was created, in milliseconds
  - `updated_at` number, required — The timestamp for when the token was last updated, in milliseconds

## Other responses

- `400` — 400 Bad Request
- `409` — 409 Conflict

---

[API](https://skmtc.net/clerk/apis/clerk-backend-api.md) · [All operations](https://skmtc.net/clerk/apis/clerk-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clerk/clerk-backend-api/revisions/75df3a43fcb2/schema)