---
title: "Create authorization"
method: POST
path: "/authorizations"
---

# Create authorization

`POST /authorizations`

Starts an authorization flow

## Request body

- CreateAuthorizationRequest
  - `challenge` string, required — The challenge that will later be needed to retrieve the token after authorization.
  - `permissions` Permission[] — The permissions that the token will have.
    - union
      - object
        - `permission` 'package/publish', required — The permission name.
        - `scope` string, required — The name of a scope. This must not be @ prefixed.
      - object
        - `permission` 'package/publish', required — The permission name.
        - `scope` string, required — The name of a scope. This must not be @ prefixed.
        - `package` string, required — The name of a package.
      - object
        - `permission` 'package/publish', required — The permission name.
        - `scope` string, required — The name of a scope. This must not be @ prefixed.
        - `package` string, required — The name of a package.
        - `version` string, required — A semantic version.
        - `tarballHash` string, required — The SHA256 hash of the tarball.

## Response `200`

OK

- CreateAuthorizationResponse
  - `verificationUrl` string, required — The URL that the user should visit to approve the authorization.
  - `code` string, required — The authorization code that the user can manually enter if they can not directly visit the link.
  - `exchangeToken` string, required — The token that can be used to exchange for a device token after the authorization has been approved.
  - `pollInterval` integer, required — The number of seconds that should be waited between polling the status of the authorization.
  - `expiresAt` string, date-time, required — The date and time until which the authorization can be approved / exchanged.

## Other responses

- `400` — Invalid request

---

[API](https://skmtc.net/jsr-io/apis/jsr-api.md) · [All operations](https://skmtc.net/jsr-io/apis/jsr-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jsr-io/jsr-api/versions/3d37ac9b68f7/schema)