---
title: "Create an Auth Token"
method: POST
path: "/v3/user/tokens"
tags: ["authentication"]
---

# Create an Auth Token

`POST /v3/user/tokens`

Creates and returns a new authentication token for the currently authenticated User. The `bearerToken` property is only provided once, in the response body, so be sure to save it on the client for use with API requests.

## Query parameters

- `teamId` string
- `slug` string

## Request body

- object
  - `name` string, required
  - `expiresAt` number
  - `projectId` string — The ID of the project to scope this token to

## Response `200`

Successful response.

- object — Successful response.
  - `token` AuthToken, required — Authentication token metadata.
    - `id` string, required — The unique identifier of the token.
    - `name` string, required — The human-readable name of the token.
    - `type` string, required — The type of the token.
    - `prefix` string — The token's prefix, for identification purposes.
    - `suffix` string — The last few characters of the token, for identification purposes.
    - `origin` string — The origin of how the token was created.
    - `scopes` union[] — The access scopes granted to the token.
      - union
        - object — The access scopes granted to the token.
          - `type` 'user', required
          - `sudo` object
            - `origin` 'email-otp' | 'otp' | 'recovery-code' | 'totp' | 'webauthn', required — Possible step-up auth origins
            - `verifiedAt` number
            - `expiresAt` number, required
          - `origin` 'app' | 'apple' | 'bitbucket' | 'chatgpt' | 'email' | 'emu' | 'github' | 'github-webhook' | 'gitlab' | 'google' | 'invite' | 'manual' | 'otp' | 'passkey' | 'saml' | 'sms' | 'token-exchange-oidc'
          - `createdAt` number, required
          - `expiresAt` number
        - object — The access scopes granted to the token.
          - `type` 'team', required
          - `teamId` string, required
          - `origin` 'app' | 'apple' | 'bitbucket' | 'chatgpt' | 'email' | 'emu' | 'github' | 'github-webhook' | 'gitlab' | 'google' | 'invite' | 'manual' | 'otp' | 'passkey' | 'saml' | 'sms' | 'token-exchange-oidc'
          - `createdAt` number, required
          - `expiresAt` number
    - `createdAt` number, required — Timestamp (in milliseconds) of when the token was created.
    - `activeAt` number, required — Timestamp (in milliseconds) of when the token was most recently used.
    - `expiresAt` number — Timestamp (in milliseconds) of when the token expires.
    - `revokedAt` number — Timestamp (in milliseconds) of when the token was revoked.
    - `leakedAt` number — Timestamp (in milliseconds) of when the token was marked as leaked.
    - `leakedUrl` string — URL where the token was discovered as leaked.
  - `bearerToken` string, required — The authentication token's actual value. This token is only provided in this response, and can never be retrieved again in the future. Be sure to save it somewhere safe!

## Other responses

- `400` — One of the provided values in the request body is invalid.
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `404`
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/versions/61d1ba3f6dac/schema)