Create a new API token
POST
/personal_access_tokens
Creates a personal access token ON THE SIGNED-IN ACCOUNT. The raw token is returned ONCE in the response — it is never stored or retrievable after this. Requires current password for session hijack protection. Session auth only. Max 20 active tokens per user, max 365-day lifetime. Ownership can never be redirected: a token authenticates AS its owner, so no caller — administrators included — may mint one on another user's account, and any user_id supplied in the body is ignored. Administrators oversee other users' tokens by listing (GET with user_id) and revoking them; account recovery goes through a password reset, where the user re-authenticates.
Request Body
application/json
JSON "personal_access_token": { "name": "CI Pipeline", "scopes": [ [ "read", "write" ] ], "expires_at": "2026-08-30", "allowed_ips": [ [ "10.0.0.0/8" ] ], "current_password": "string" }
{
}
Responses
Token created — raw token shown once
application/json
JSON "token": "vulcan_a8BfDtSxd28fDXCuYaKxkeToqqJsmq5PekL6", "personal_access_token": { "id": 1, "name": "CI Pipeline", "token_prefix": "vulcan_a", "scopes": [ [ "read", "write" ] ], "expires_at": "2026-08-30", "last_used_at": "2026-05-30 14:22:01 UTC", "revoked_at": "string", "allowed_ips": [ ], "created_at": "2026-05-30 10:00:00 UTC" }
{
}