Skip to main content

Mint an access token

POST 
/api_tokens

Creates a personal access token. The raw pat_… secret is returned once in meta.token and never again. Send an Idempotency-Key header to make a retried mint safe.

The body takes the data.attributes envelope — a flat body is rejected with 400.

Pass integration_source_id (the src_… id from POST /ingest/sources) to mint an app credential rather than a personal token. An app credential belongs to the workspace's connected integration, so it survives the offboarding of whoever created it, honours that integration's IP allowlist, dies with one Disconnect, and is the only kind of token on which the per-resource scopes below are enforced.

This endpoint is itself rate-limited per hour — mint once and store the secret, do not mint per deploy.

Request​

Responses​

Created — raw secret in meta.token (shown once).