---
title: "Create API token"
method: POST
path: "/api/api-tokens"
tags: ["API Tokens"]
---

# Create API token

`POST /api/api-tokens`

Generates a new scoped API token. The full token is only returned in the creation response
and cannot be retrieved again. Requires admin role.

**Note:** API tokens cannot create other API tokens.

## Request body

- object
  - `name` string, required — Human-readable token name. Must be unique among the user's active tokens.
  - `scope` 'read-only' | 'deploy-only' | 'full-admin', required — Permission scope: - `read-only` — GET requests only - `deploy-only` — Read + stack deploy/stop/restart operations - `full-admin` — All operations (except license, user, and token management)
  - `expires_in` 30 | 60 | 90 | 365 | null, nullable — Token lifetime in days. Use `null` for no expiry.

## Response `201`

Token created. The `token` field contains the full JWT. Save it now; it will not be shown again.

- object
  - `id` integer, required
  - `token` string, required — Full JWT token. Store securely — this is the only time it's returned.

## Other responses

- `400` — Validation error (missing/invalid fields, or maximum of 25 active tokens reached).
- `403` — Insufficient permissions or license tier.
- `409` — An active token with this name already exists.
- `500` — Internal server error.

---

[API](https://skmtc.net/studio-saelix/apis/sencho-api.md) · [All operations](https://skmtc.net/studio-saelix/apis/sencho-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/studio-saelix/sencho-api/versions/f36f82acae1d/schema)