---
title: "Derive scoped API token"
method: POST
path: "/auth/api-tokens/derive"
tags: ["API Tokens"]
---

# Derive scoped API token

`POST /auth/api-tokens/derive`

Creates a new scoped API token for the authenticated partner. Requires Privy authentication (Bearer token). The token secret is returned once at creation — store it securely. Requested scopes must be a subset of the partner's allowed scopes.

## Request body

- DeriveApiTokenRequest
  - `label` string — Human-readable label for the token
  - `scopes` string[] — Scopes to grant. Defaults to ["trading"] if omitted. Must be a subset of the partner's allowed scopes. `delegated_signing` requires `trading`.

## Response `201`

Token created successfully. The secret is only returned once.

- DeriveApiTokenResponse
  - `apiKey` string, required — The token ID, used as the `lmts-api-key` header value for HMAC requests
  - `secret` string, required — Base64-encoded secret for HMAC signing. Returned once — store securely.
  - `tokenId` string, required — Same as apiKey. The unique token identifier.
  - `createdAt` string, date-time, required — Token creation timestamp
  - `scopes` string[], required — Granted scopes
  - `profile` object, required
    - `id` integer — Partner profile ID
    - `account` string — Partner wallet address

## Other responses

- `400` — Invalid scopes or profile not found
- `401` — Requires Privy authentication
- `403` — Token management not enabled or requested scopes not allowed for this partner

---

[API](https://skmtc.net/limitless-labs-group/apis/limitless-exchange-api.md) · [All operations](https://skmtc.net/limitless-labs-group/apis/limitless-exchange-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/limitless-labs-group/limitless-exchange-api/versions/f60847044e0d/schema)