> ## Documentation Index
> Fetch the complete documentation index at: https://help.pixwel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a personal access token

> Issues a token that authenticates as the calling user with their full permissions. The raw value is returned once in this response. A user may hold at most 20 unrevoked tokens — expired ones still count against the cap until revoked — and tokens cannot be created while impersonating.



## OpenAPI

````yaml /openapi.yaml post /personal-access-tokens
openapi: 3.1.0
info:
  title: Pixwel Platform
  description: >-
    The Pixwel Platform REST API. Authenticate with HTTP Basic (email +
    password) or a personal access token (`Authorization: Bearer pat_…`).
    Responses are decorated by proxy middleware (Fields, Links, Permissions,
    etc.). Use `?fields=` to request specific fields.
  version: '2.8'
  contact:
    email: jeff@pixwel.com
  license:
    name: UNLICENSED
    identifier: LicenseRef-Pixwel-Proprietary
servers:
  - url: https://api-staging.pixwel.com/api
    description: Staging
  - url: https://app.pixwel.com/api
    description: Production
security:
  - BasicAuth: []
  - BearerAuth: []
paths:
  /personal-access-tokens:
    post:
      tags:
        - PersonalAccessTokens
      summary: Create a personal access token
      description: >-
        Issues a token that authenticates as the calling user with their full
        permissions. The raw value is returned once in this response. A user may
        hold at most 20 unrevoked tokens — expired ones still count against the
        cap until revoked — and tokens cannot be created while impersonating.
      operationId: createPersonalAccessToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PersonalAccessTokenCreate'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PersonalAccessTokenCreated'
        '400':
          description: Missing or blank name, invalid expiresAt, or token limit reached
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: string
        '401':
          description: Not authenticated
        '403':
          description: Cannot create tokens while impersonating
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: string
components:
  schemas:
    PersonalAccessTokenCreate:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          minLength: 1
          pattern: \S
          description: >-
            Label describing where the token is used. Trimmed, and must not be
            empty or whitespace-only.
        expiresAt:
          type:
            - integer
            - string
            - 'null'
          description: >-
            Unix timestamp or any `strtotime`-parsable string. Defaults to 90
            days; must be in the future and no more than 1 year out.
    PersonalAccessTokenCreated:
      allOf:
        - $ref: '#/components/schemas/PersonalAccessToken'
        - type: object
          required:
            - token
          properties:
            token:
              type: string
              description: >-
                The raw token (`pat_` + 64 hex characters). Returned only here,
                at creation — it is stored hashed and can never be read back.
    PersonalAccessToken:
      type: object
      required:
        - _id
        - name
        - tokenPrefix
        - createdAt
        - lastUsedAt
        - expiresAt
        - revokedAt
      properties:
        _id:
          type: string
        name:
          type: string
          description: User-supplied label, e.g. `ci-deploy`
        tokenPrefix:
          type: string
          description: First 8 hex characters after `pat_`, for telling tokens apart
        createdAt:
          type: integer
          description: Unix timestamp
        lastUsedAt:
          type:
            - integer
            - 'null'
          description: >-
            Unix timestamp of the last request made with this token (throttled
            to one write per minute)
        expiresAt:
          type: integer
          description: Unix timestamp after which the token stops working
        revokedAt:
          type:
            - integer
            - 'null'
          description: Unix timestamp at which the token was revoked
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
      description: >-
        Email address and password. A personal access token (`pat_…`) or session
        token (`token-…`) may also be sent in the password field, with any
        non-empty value as the username — a blank username short-circuits to a
        401 before the token is read.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: pat_<64 hex characters>
      description: >-
        A personal access token: `Authorization: Bearer pat_…`. Create one under
        Preferences → API Tokens, or with `POST /personal-access-tokens`. The
        token acts as its owner, with their full permissions.

````