Create a personal access token
Issues a token that authenticates as the calling user with their full permissions. The raw value is returned once in this response. A user may hold at most 20 unrevoked tokens — expired ones still count against the cap until revoked — and tokens cannot be created while impersonating.
Authorizations
Email address and password. A personal access token (pat_…) or session token (token-…) may also be sent in the password field, with any non-empty value as the username — a blank username short-circuits to a 401 before the token is read.
Body
Response
Created
User-supplied label, e.g. ci-deploy
First 8 hex characters after pat_, for telling tokens apart
Unix timestamp
Unix timestamp of the last request made with this token (throttled to one write per minute)
Unix timestamp after which the token stops working
Unix timestamp at which the token was revoked
The raw token (pat_ + 64 hex characters). Returned only here, at creation — it is stored hashed and can never be read back.