---
title: "Generate an API key for a user"
method: POST
path: "/users/{id}/tokens"
tags: ["users"]
---

# Generate an API key for a user

`POST /users/{id}/tokens`

Generates an API key for a user.
Only the calling user can generate a token for themselves.
Password is required only for internal authentication.
**Access policy**: restricted

## Path parameters

- `id` integer, required

## Request body

- UsersUserAccessTokenCreatePayload
  - `description` string, required
  - `password` string, required

## Response `200`

Success

- UsersAccessTokenResponse
  - `apiKey` PortainerAPIKey
    - `dateCreated` integer — Unix timestamp (UTC) when the API key was created
    - `description` string
    - `digest` string — Digest represents SHA256 hash of the raw API key
    - `id` integer
    - `lastUsed` integer — Unix timestamp (UTC) when the API key was last used
    - `prefix` string — API key identifier (7 char prefix)
    - `userId` integer
  - `rawAPIKey` string

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `403` — Permission denied
- `404` — User not found
- `500` — Server error

---

[API](https://skmtc.net/portainer/apis/portainerce-api.md) · [All operations](https://skmtc.net/portainer/apis/portainerce-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/portainer/portainerce-api/versions/c0b0975cd11b/schema)