---
title: "Create a new token"
method: POST
path: "/auth/token"
tags: ["auth"]
---

# Create a new token

`POST /auth/token`

Bearer tokens can be used to authenticated without session or without sending credentials.

If the user making the request has sufficient privileges, he is allowed to create a token on behalf of another user.
Otherwise only a token for the request current user is allowed.


**Permission required:** edit_users

## Headers

- `X-Fields` string, mask

## Request body

- TokenModelBase
  - `roles` TokenRoleModel[] — the user roles
    - `document_id` string — limited to a document
    - `inbox` string
    - `role` string, required
  - `username` string, required — the user username

## Response `201`

Success

- TokenReplyModel
  - `authentication_token` string, required

## Other responses

- `403` — Permission insufficient

---

[API](https://skmtc.net/contractp/apis/contract-p.md) · [All operations](https://skmtc.net/contractp/apis/contract-p/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/contractp/contract-p/revisions/8ce53ebd6bd3/schema)