---
title: "Create an API token"
method: POST
path: "/users/{user_id}/api-tokens"
tags: ["API Tokens"]
---

# Create an API token

`POST /users/{user_id}/api-tokens`

Creates an API token

## Request body

- object
  - `name` string, required — The token name.

## Response `201`

Created

- APIToken
  - `id` string, uuid — The ID of the token.
  - `name` string — The token name.
  - `mfa_on_creation` boolean — Whether the user had multi-factor authentication (MFA) enabled when they created the token.
  - `token` string — The token in plain text (available only when created).
  - `created_at` string, date-time — The date and time when the token was created.
  - `updated_at` string, date-time — The date and time when the token was last updated.
  - `last_used_at` string, date-time, nullable — The date and time when the token was last exchanged for an access token. This will be <code>null</code> for a token which has never been used, or not used since this API property was added. <strong>Note:</strong> After an API token is used, the derived access token may continue to be used until its expiry. This also applies to SSH certificate(s) derived from the access token.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `409` — Conflict

---

[API](https://skmtc.net/upsun/apis/upsun-com-rest-api.md) · [All operations](https://skmtc.net/upsun/apis/upsun-com-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/upsun/upsun-com-rest-api/revisions/6cc88fde6435/schema)