---
title: "Generate a one-time provisioning token (owner/admin, provider only)"
method: POST
path: "/v1/orgs/{orgId}/provider/tokens"
tags: ["Provider"]
---

# Generate a one-time provisioning token (owner/admin, provider only)

`POST /v1/orgs/{orgId}/provider/tokens`

## Path parameters

- `orgId` string, required

## Request body

- GenerateProvisioningTokenRequest
  - `expiresInHours` integer
  - `maxNodes` integer — Enrollment quota; 0/omitted = unlimited
  - `name` string
  - `runtime` 'qemu' | 'runc' — Node runtime this token provisions: qemu (VFIO VM host, the default) or runc (GPU-container Pod node). Drives NODE_RUNTIME in the one-command bootstrap.

## Response `200`

Created

- ProvisioningTokenCreated
  - `expiresAt` string, nullable
  - `id` string, required
  - `maxNodes` integer
  - `name` string, nullable
  - `nodePool` string
  - `runtime` string — Node runtime this token provisions (qemu | runc).
  - `token` string, required
  - `tokenPrefix` string, required
  - `warning` string, required

## Other responses

- `400` — The request is invalid
- `401` — Missing or invalid API key
- `403` — API key lacks the required scope

---

[API](https://skmtc.net/openrelay/apis/openrelay-api.md) · [All operations](https://skmtc.net/openrelay/apis/openrelay-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openrelay/openrelay-api/versions/32905b8f44f8/schema)