---
title: "Create API token"
method: POST
path: "/iam/v2/clients/{clientId}/tokens"
tags: ["API Tokens"]
---

# Create API token

`POST /iam/v2/clients/{clientId}/tokens`

Create an API token in the current account.

This V2 endpoint generates tokens that use `_` (underscore) as the separator
between the token ID and the secret string, instead of the `$` separator
used by the V1 endpoint. For example: `42_a1b2c3d4...`

Tokens created via this endpoint are fully compatible with all existing
authentication mechanisms.

## Path parameters

- `clientId` integer, required

## Request body

- Token2
  - `name` string, required — API token name.
  - `description` string — API token description.
  - `exp_date` string, nullable, required — Date when the API token becomes expired (ISO 8086/RFC 3339 format), UTC. If null, then the API token will never expire.
  - `client_user` object, required — API token role.
    - `role` Group
      - `id` integer — Group's ID: Possible values are: - 1 - Administrators* 2 - Users* 5 - Engineers* 3009 - Purge and Prefetch only (API+Web)* 3022 - Purge and Prefetch only (API)
      - `name` 'Users' | 'Administrators' | 'Engineers' | 'Purge and Prefetch only (API)' | 'Purge and Prefetch only (API+Web)' — Group's name.

## Response `200`

OK.

- CreateTokenResponseV2
  - `token` string — API token with `_` separator. Copy it, because you will not be able to get it again. We do not store tokens. All responsibility for token storage and usage is on the issuer.
  - `name` string, required — API token name.
  - `description` string — API token description.
  - `exp_date` string, nullable, required — Date when the API token becomes expired (ISO 8086/RFC 3339 format), UTC. If null, then the API token will never expire.
  - `client_user` object, required — API token role and issuer data.
    - `role` Group, required
      - `id` integer — Group's ID: Possible values are: - 1 - Administrators* 2 - Users* 5 - Engineers* 3009 - Purge and Prefetch only (API+Web)* 3022 - Purge and Prefetch only (API)
      - `name` 'Users' | 'Administrators' | 'Engineers' | 'Purge and Prefetch only (API)' | 'Purge and Prefetch only (API+Web)' — Group's name.
    - `deleted` boolean, required — Deletion flag. If true, then the API token was deleted.
    - `user_id` integer, required — User's ID who issued the API token.
    - `user_name` string, required — User's name who issued the API token.
    - `user_email` string, required — User's email who issued the API token.
    - `client_id` integer, required — Account's ID.
  - `id` integer, required — API token ID.
  - `deleted` boolean, required — Deletion flag. If true, then the API token was deleted.
  - `expired` boolean, required — Expiration flag. If true, then the API token has expired. When an API token expires it will be automatically deleted.
  - `created` string, required — Date when the API token was issued (ISO 8086/RFC 3339 format), UTC.
  - `last_usage` string, required — Date when the API token was last used (ISO 8086/RFC 3339 format), UTC.

## Other responses

- `400` — API token creation failed.

---

[API](https://skmtc.net/g-core/apis/gcore-openapi.md) · [All operations](https://skmtc.net/g-core/apis/gcore-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/g-core/gcore-openapi/revisions/09e652815095/schema)