---
title: "Create a service token"
method: POST
path: "/tokens"
tags: ["tokens"]
---

# Create a service token

`POST /tokens`

Create a service token for machine-to-machine authentication. Accepts API key or bearer token. Optionally apply restrictions.

## Request body

- CreateTokenRequest
  - `policy` Constraint[] — Constraint objects to restrict the token. Each constraint may include a `ttl` field (max 24 hours). Default TTL is 1 hour. Maximum is 24 hours.
    - `namespaces` union — Namespace(s) the token is scoped to. Accepts a single slug or an array.
      - string
      - string[]
    - `resources` union — Resource type(s) the token may access: connections, servers, namespaces, or skills.
      - 'connections' | 'servers' | 'namespaces' | 'skills'
      - string[]
    - `operations` union — Operation(s) the token may perform: read, write, or execute.
      - 'read' | 'write' | 'execute'
      - string[]
    - `metadata` union — Key-value metadata for fine-grained filtering. A single object requires all pairs to match (AND). An array of objects requires any one to match (OR-of-AND), e.g. [{"userId":"alice"},{"team":"backend"}] grants access when either condition is met.
      - object
      - object[]
    - `ttl` union — Time-to-live for the constraint. Accepts seconds (number) or a duration string such as "1h", "30m", or "20s".
      - string
      - number
    - `rpcReqMatch` object — MCP JSON-RPC request matching rules. Keys are dot-paths into the request body (e.g. "params.name", "method"). Values are regex patterns. All entries must match (AND).
  - `organizationId` string — Optional organization ID to scope the token to. When provided, the token is minted with org context. The authenticated user must be an admin or owner of the organization.

## Response `200`

Token created successfully

- CreateTokenResponse
  - `token` string, required — The signed service token.
  - `expiresAt` string, required — ISO 8601 timestamp when the token expires.

## Other responses

- `400` — Bad request (invalid parameters)
- `401` — Unauthorized (missing or invalid credentials)
- `403` — Forbidden

---

[API](https://skmtc.net/smithery-ai/apis/smithery-platform-api.md) · [All operations](https://skmtc.net/smithery-ai/apis/smithery-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/smithery-ai/smithery-platform-api/revisions/60b8c3d2fecf/schema)