---
title: "Create a token"
method: POST
path: "/v3/tokens"
tags: ["Tokens"]
---

# Create a token

`POST /v3/tokens`

Creates an API Access Token.

Each grant ties a connection to a source — a fully qualified table name, a
SQL query, or `*` for everything reachable through that connection. Keep
grants as narrow as your application allows.

## Request body

- TokenRequest
  - `grants` Grant[], required
    - `connection_name` string, required
    - `source` string
    - `resource` string
  - `allowed_apis` TokenAllowedApi[], required — Which APIs this token can call.
  - `referers` string[] — Restrict use of the token to these HTTP referers. Empty means any.
  - `name` string — A name for the token. Generated if omitted.
  - `expiration_date` string, date-time — When the token stops working. Must be in the future. Omit for a token that never expires. Can only be set at creation.

## Response `201`

The token was created.

- Token
  - `token` string — The token to send in the `Authorization` header.
  - `grants` Grant[]
    - `connection_name` string, required
    - `source` string
    - `resource` string
  - `allowed_apis` TokenAllowedApi[]
  - `referers` string[], nullable
  - `name` string
  - `user_id` string, nullable
  - `account_id` string
  - `created_at` string, date-time
  - `updated_at` string, date-time
  - `expiration_date` string, date-time, nullable

## Other responses

- `400` — The request is malformed or a parameter failed validation.
- `401` — The token is missing, malformed or expired.
- `403` — The token doesn't grant access to this resource.
- `429` — You went over the [rate limit](#rate-limits) for this API.

---

[API](https://skmtc.net/gitbookio/apis/carto-api.md) · [All operations](https://skmtc.net/gitbookio/apis/carto-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitbookio/carto-api/revisions/019f79ecdd6c/schema)