---
title: "Mint a short-lived scoped token whose scopes limit what the holder
can do, e.g. install a specific asset on a device through the
registry. The token is verified offline by services holding the
token signing public key and cannot be revoked, so keep TTLs short.
It is bound to the authenticated caller's organization."
method: POST
path: "/v1/scoped_tokens"
---

# Mint a short-lived scoped token whose scopes limit what the holder
can do, e.g. install a specific asset on a device through the
registry. The token is verified offline by services holding the
token signing public key and cannot be revoked, so keep TTLs short.
It is bound to the authenticated caller's organization.

`POST /v1/scoped_tokens`

## Request body

- ScopedTokenCreate
  - `scopes` string[], required — Scopes in the form `<resource>:<id|*>:<action>`, e.g. `device:*:install`, `asset:asset_01h455vb4pex5vsknk084sn02q:read` or `applerelay:*:connect`. Resource IDs are the customer-visible IDs returned by the API.
  - `ttlSeconds` integer — How long the token stays valid. Defaults to 3600 (1 hour), maximum is 14400 (4 hours).

## Response `200`

OK

- ScopedToken
  - `token` string, required — The scoped token, to be sent as a Bearer token or the token query parameter.
  - `scopes` string[], required
  - `expiresAt` string, date-time, required

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `500` — Internal Server Error

---

[API](https://skmtc.net/limrun-inc/apis/limrun-api.md) · [All operations](https://skmtc.net/limrun-inc/apis/limrun-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/limrun-inc/limrun-api/revisions/0a3cd7959546/schema)