Skip to main content
POST
Create a personal access token

Authorizations

Authorization
string
header
required

Email address and password. A personal access token (pat_…) or session token (token-…) may also be sent in the password field, with any non-empty value as the username — a blank username short-circuits to a 401 before the token is read.

Body

application/json
name
string
required

Label describing where the token is used. Trimmed, and must not be empty or whitespace-only.

Minimum string length: 1
Pattern: \S
expiresAt

Unix timestamp or any strtotime-parsable string. Defaults to 90 days; must be in the future and no more than 1 year out.

Response

Created

_id
string
required
name
string
required

User-supplied label, e.g. ci-deploy

tokenPrefix
string
required

First 8 hex characters after pat_, for telling tokens apart

createdAt
integer
required

Unix timestamp

lastUsedAt
integer | null
required

Unix timestamp of the last request made with this token (throttled to one write per minute)

expiresAt
integer
required

Unix timestamp after which the token stops working

revokedAt
integer | null
required

Unix timestamp at which the token was revoked

token
string
required

The raw token (pat_ + 64 hex characters). Returned only here, at creation — it is stored hashed and can never be read back.