---
title: "Generate a provisioning token (owner/admin session, provider org only)"
method: POST
path: "/v1/orgs/{orgId}/provider/tokens"
tags: ["Provider"]
---

# Generate a provisioning token (owner/admin session, provider org only)

`POST /v1/orgs/{orgId}/provider/tokens`

## Path parameters

- `orgId` string, required

## Request body

- GenerateProvisioningTokenRequest — Every token lives 24 hours from creation and enrolls any number of nodes in that window; neither is a request input. The node runtime is not a token property; each node detects its own shape at enroll (baremetal becomes qemu, a cloud guest becomes runc). Expired and revoked tokens stay listed for 7 days after creation, then fall out.
  - `name` string

## Response `200`

Created

- ProvisioningTokenCreated
  - `expiresAt` string, required — 24 hours after creation.
  - `id` string, required
  - `name` string, nullable
  - `nodePool` string
  - `token` string, required
  - `tokenPrefix` string, required
  - `warning` string, required

## Other responses

- `400` — The request is invalid
- `401` — Missing or invalid API key
- `403` — API key lacks the required scope

---

[API](https://skmtc.net/openrelay/apis/openrelay-api.md) · [All operations](https://skmtc.net/openrelay/apis/openrelay-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openrelay/openrelay-api/revisions/c8ee30a7762d/schema)