---
title: "Create access token"
method: POST
path: "/access_tokens"
tags: ["Access tokens"]
---

# Create access token

`POST /access_tokens`

Create a short-lived access token for authenticating API requests. When using API key authentication, provide company_id or user_id. When using OAuth, the user is derived from the token. Use this token with Whop's web and mobile embedded components.

## Request body

- object — Parameters for CreateAccessToken
  - `company_id` string, nullable — The unique identifier of the company to generate the token for, starting with 'biz_'. The API key must have permission to access this company.
  - `expires_at` string, date-time, nullable — The expiration timestamp for the access token. Defaults to 1 hour from now, with a maximum of 3 hours.
  - `scoped_actions` string[], nullable — An array of permission scopes to grant to the access token. If empty or omitted, all permissions from the authenticating credential are inherited. Must be a subset of the credential's permissions.
  - `user_id` string, nullable — The unique identifier of the user to generate the token for, starting with 'user_'. The API key must have permission to access this user.

## Response `200`

A successful response

- AccessToken — A short-lived access token used to authenticate API requests on behalf of a user.
  - `expires_at` string, date-time, required — The timestamp after which this access token is no longer valid and must be refreshed.
  - `token` string, required — The signed JWT access token string to include in API request Authorization headers.

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `422` — Verification required
- `429` — Too many requests
- `500` — Internal server error

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/a8a43db4255f/schema)