Generate a new personal access token

Generates a new personal access token (API key) for the authenticated user, scoped to the current tenant. Use this endpoint to create a named, expiry-controlled API key for programmatic access to the Esper API.

About Generate Personal Access Token

Personal access tokens are named, expiry-controlled API keys tied to a specific user and tenant. They replace the legacy developer app token system (see POST /v0/enterprise/{enterprise_id}/developerapp/{developerapp_id}/renew-token/, which is deprecated). Personal access tokens are scoped to the authenticated caller — this endpoint generates an API key for the user associated with the API key making the request, and cannot be used to create API keys on behalf of other users. The full API key value is returned only in the response to this create call — it is not retrievable again via the list endpoint, which returns only the key prefix. Store the API key value securely immediately after creation.

Key Fields / Request Body

name — (required) a human-readable label for the API key, used to identify it in the token list

description — (required) a description of the API key's intended use

expiry_at — (required) the expiry date as a Unix timestamp integer; set to -1 for a non-expiring API key

Key Fields (Response)

id — the UUID of the newly created token record; store this for use in renewal and deletion calls

token — the full API key value; this is the only time it is returned — store it securely immediately

prefix — a short prefix of the API key, used to identify it in future list responses

expiry_at — the expiry timestamp as set in the request

Common Use Cases

Creating an API key for a CI/CD pipeline or automated script

Generating a long-lived API key for an integration that cannot handle session-based authentication

Issuing a dedicated API key for a specific integration or team member

Best Practices

Store the token value from the response immediately and securely — it cannot be retrieved again after this call

Store the id alongside the API key value for future renewal or deletion via PUT and DELETE /authn2/v0/personal-access-token/{personal_access_token_id}

Set a meaningful expiry_at value rather than using -1 (no expiry) wherever possible — expiring API keys reduce the blast radius of credential leaks

Use distinct name and description values per API key to make the list endpoint actionable during audits

Workflow

POST to this endpoint with a name, description, and expiry_at

Immediately store the returned token value and id securely

Use the API key value in subsequent Esper API calls

Track the expiry_at and renew via PUT /authn2/v0/personal-access-token/{personal_access_token_id} before expiry