---
title: "Create personal access token"
method: POST
path: "/user/tokens"
---

# Create personal access token

`POST /user/tokens`

Creates a new personal access token for the authenticated user

## Request body

- CreateTokenRequest
  - `description` string, required — The description of the token.
  - `expiresAt` string, date-time, nullable — The date and time when the token expires.
  - `permissions` Permission[], nullable — The permissions that the token will have. Must contain exactly one element if provided.
    - union
      - object
        - `permission` 'package/publish', required — The permission name.
        - `scope` string, required — The name of a scope. This must not be @ prefixed.
      - object
        - `permission` 'package/publish', required — The permission name.
        - `scope` string, required — The name of a scope. This must not be @ prefixed.
        - `package` string, required — The name of a package.
      - object
        - `permission` 'package/publish', required — The permission name.
        - `scope` string, required — The name of a scope. This must not be @ prefixed.
        - `package` string, required — The name of a package.
        - `version` string, required — A semantic version.
        - `tarballHash` string, required — The SHA256 hash of the tarball.

## Response `200`

OK

- CreatedToken
  - `secret` string, required — The secret value of the token. This is only returned once when the token is created.
  - `token` Token, required
    - `id` string, uuid, required — The ID of the token.
    - `description` string, nullable — The description of the token.
    - `userId` string, uuid, required — The ID of a user.
    - `type` 'web' | 'device' | 'personal', required — The type of token.
    - `expiresAt` string, date-time, nullable — The date and time when the token expires.
    - `permissions` Permission[], nullable
      - union
        - object
          - `permission` 'package/publish', required — The permission name.
          - `scope` string, required — The name of a scope. This must not be @ prefixed.
        - object
          - `permission` 'package/publish', required — The permission name.
          - `scope` string, required — The name of a scope. This must not be @ prefixed.
          - `package` string, required — The name of a package.
        - object
          - `permission` 'package/publish', required — The permission name.
          - `scope` string, required — The name of a scope. This must not be @ prefixed.
          - `package` string, required — The name of a package.
          - `version` string, required — A semantic version.
          - `tarballHash` string, required — The SHA256 hash of the tarball.
    - `updatedAt` string, date-time, required — The date and time when the token was last updated.
    - `createdAt` string, date-time, required — The date and time when the token was created.

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — Token type does not allow creating tokens

---

[API](https://skmtc.net/deno/apis/jsr.md) · [All operations](https://skmtc.net/deno/apis/jsr/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deno/jsr/versions/3d37ac9b68f7/schema)