---
title: "Create a token"
method: POST
path: "/tokens"
tags: ["Tokens"]
---

# Create a token

`POST /tokens`

Create an authentication token for a client application installation.

⚠️ Endpoint is available only in the Customer interface.

⚠️ When creating a new token, the request does not need to contain an Authentication header.

⚠️ We highly recommend filling all identifications in the tokens resource (device and application) to avoid problems if multiple applications use the CareCloud REST API on one device.

**What happens when a token is created**

- A token record is created and its server-generated `token_id` is returned.
- The token is bound to the supplied `device` identification and `setup` parameters (language, GPS permission, notifications permission).
- The token is used as the credential on subsequent customer-interface requests, sent as `Authorization: Bearer <token_id>`. See [Authentication](https://carecloud.readme.io/reference/authentication) for the full flow.

## Headers

- `Accept-Language` string

## Request body

- object
  - `device` Device, required — Structure describes the client device or browser.
    - `device_id` string, required — The unique ID of the client device.
    - `device_system` string, required — Operation system of the device.
    - `device_name` string, required — The name of the device.
    - `device_type` string, required — Type of device by producer (product line).
  - `setup` Setup, required — Setup of a client's device.
    - `language_id` string, required — The unique ID of the language by ISO 639-1 code from [GET /languages](https://carecloud.readme.io/reference/getlanguages).
    - `allowed_gps` boolean, required — Permission to GPS tracking in the mobile application.
    - `allowed_notifications` boolean, required — Permission to the mobile application notifications.
  - `external_application_id` string, required — ID of the external application. More information about external applications and how to get an ID is available in [Authentication section](https://carecloud.readme.io/reference/authentication#external-applications-1)
  - `push_token` string — Push notification token (Apple or Google).

## Response `201`

Created

- object
  - `data` object
    - `token_id` string — The client application token.

## Other responses

- `400` — Bad input parameter. The response body's `error.error_data.invalid_params[]` array lists the parameters that caused the failure, each carrying a `reason` code. See the `BadRequestErrorBody` schema for the generic reason taxonomy. Operations with domain-specific business rules document additional reasons at the operation level.
- `403` — The client does not exist or the client tried to access an unauthorized property or resource.
- `404` — The resource was not found.
- `405` — The resource does not support the specified HTTP method.
- `429` — Too many requests - more than the resource limit.
- `500` — Server is not working as expected.
- `503` — Temporary state when the service is temporarily unavailable, overloaded or there is a maintenance window.

---

[API](https://skmtc.net/crmcarecloud/apis/rest-api-reference.md) · [All operations](https://skmtc.net/crmcarecloud/apis/rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/crmcarecloud/rest-api-reference/revisions/329c06dbf8d9/schema)