---
title: "Mint a workspace Agent token"
method: POST
path: "/v1/workspaces/{workspaceId}/agent-tokens"
tags: ["Workspaces"]
---

# Mint a workspace Agent token

`POST /v1/workspaces/{workspaceId}/agent-tokens`

Mints a non-human, workspace-scoped Agent token (prefix `sot_`). Creates a headless service principal and adds it as a first-class workspace member that owns the artifacts it publishes. Plaintext token is returned exactly once. Owner/admin only.

## Request body

- object
  - `name` string, required — Human label, e.g. "CI bot".
  - `scopes` string[], required
  - `expires_at` string, nullable — Optional ISO datetime; omit for no expiry.

## Response `201`

Token minted (plaintext shown once)

- object
  - `ok` boolean
  - `token` string
  - `shown_once` boolean
  - `token_id` string
  - `principal_user_id` string
  - `scopes` string[]

## Other responses

- `400` — Missing name or invalid scopes
- `403` — Caller is not a workspace owner/admin

---

[API](https://skmtc.net/shareout/apis/shareout-rest-api.md) · [All operations](https://skmtc.net/shareout/apis/shareout-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/shareout/shareout-rest-api/revisions/804359ead65a/schema)