> ## Documentation Index > Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a personal access token > Creates a `qumo_pat_` token that acts as the signed-in user, capped by the scopes you give it, and valid for 30 days. The token value is returned only in this response. Requires a console or CLI session. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/auth/tokens openapi: 3.1.0 info: title: Qumo Deploy REST API description: > The Qumo Deploy control plane: organizations, projects, signing keys, machine identities, access control, audit and billing. Relay credentials are not issued here: your app signs them with its own [signing keys](/guides/signing-keys). Every operation here is generated against the routes the server registers and checked in CI, so an operation in this reference exists and a route missing from it is deliberately internal (relay mesh, webhooks, probes, operator-only and browser sign-in routes). Errors are JSON objects with one `error` field. What each status code means is in [Error codes](/guides/error-codes); the token scope each permission needs is in [Scopes and permissions](/guides/scopes-permissions). version: 1.0.0 servers: - url: https://api.qumo-deploy.com description: Public API (Bearer tokens only; cookies are ignored) security: [] tags: - name: Account description: The signed-in user's own sessions, tokens, security settings and data. - name: Device flow description: OAuth 2.0 device authorization, used by `qumod login`. - name: Organizations description: Organizations, their members and usage. - name: Projects description: Projects inside an organization. - name: Signing keys description: Keys your app signs relay credentials with. - name: Relays description: Where clients of a broadcast path connect. - name: Identities description: Machine identities, their tokens and IP allowlists. - name: Access control description: Roles, IAM bindings and invitations. - name: Audit description: The audit log and its webhook. - name: Notifications description: Notification policies. - name: Billing description: Plans, usage cost, budgets, invoices and payment methods. - name: Pricing description: Public price list. paths: /v1/auth/tokens: post: tags: - Account summary: Create a personal access token description: | Creates a `qumo_pat_` token that acts as the signed-in user, capped by the scopes you give it, and valid for 30 days. The token value is returned only in this response. Requires a console or CLI session. operationId: createPersonalToken requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PersonalTokenCreateRequest' responses: '201': description: >- The token was created. Store `value` now; it cannot be retrieved again. headers: Cache-Control: description: Always `no-store`. schema: type: string example: no-store content: application/json: schema: $ref: '#/components/schemas/PersonalTokenCreated' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' security: - cliSession: [] - sessionCookie: [] csrfToken: [] components: schemas: PersonalTokenCreateRequest: type: object required: - name - scopes properties: name: type: string minLength: 1 maxLength: 100 description: >- A display name, at most 100 characters. Surrounding whitespace is trimmed. example: ci-deploy scopes: type: array minItems: 1 description: | The scopes the token may use, at least one. `*` grants every scope the user's own roles allow. See [Scopes and permissions](/guides/scopes-permissions). items: type: string enum: - '*' - project:read - usage:read - audit:read - audit:admin - iam:read - iam:admin - organization:admin - billing:admin - signing_keys:admin example: - project:read - usage:read PersonalTokenCreated: allOf: - $ref: '#/components/schemas/PersonalToken' - type: object required: - value properties: value: type: string description: The token secret. Shown only in this response. example: >- qumo_pat_3c9e1a7f5b2d8e4a0f6c3b9d7e1a5c2f8d4b0e6a2c9f7d3b1e5a8c0f4b6d2e9a PersonalToken: type: object description: A personal access token's metadata. The token value is never included. required: - id - name - scopes - created_at - expires_at properties: id: type: string format: uuid example: 7d9f1b3e-5a7c-4e9b-b1d3-f5a7c9e1b3d5 name: type: string example: ci-deploy scopes: type: array description: >- The scopes the token holds. See [Scopes and permissions](/guides/scopes-permissions). items: type: string example: - project:read - usage:read created_at: type: string format: date-time example: '2026-10-04T09:12:44Z' expires_at: type: string format: date-time description: 30 days after creation. example: '2026-11-03T09:12:44Z' Error: type: object required: - error properties: error: type: string description: A human-readable message. example: organization_id is required responses: BadRequest: description: >- Malformed request or failed validation. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing or invalid credentials. See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- Authenticated but not allowed (permission, token scope, IP allowlist or CSRF). See [Error codes](/guides/error-codes). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: cliSession: type: http scheme: bearer description: | The session token `qumod login` obtains through the device flow (`POST /v1/auth/device/token`). It acts as the signed-in user, like a console session, and needs no CSRF token. sessionCookie: type: apiKey in: cookie name: __Host-qumo_session description: | The console's browser session. Accepted only on the console origin (`https://console.qumo-deploy.com`), never on `api.qumo-deploy.com`. A request that changes state must also send `X-CSRF-Token`. csrfToken: type: apiKey in: header name: X-CSRF-Token description: | CSRF token paired with `sessionCookie` on POST, PUT, PATCH and DELETE. Bearer requests do not send it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.