create_token
Mint a personal access token — attenuated to the calling token, scoped to one team; the plaintext travels once in the answer.
Mint a token with a name, the abilities it holds and the team_id it is minted for, the
operation POST /v1/tokens performs. The minting policy is attenuation: every ability asked
for must be one the calling token itself holds, token:create is withheld unconditionally so
a token can never delegate minting, and the team must be one the caller owns or belongs to —
it becomes the new token's frozen scope:team: and cannot be widened later.
The answer is the list_tokens row plus token, the plaintext.
The plaintext exists once
token is the only time the value exists outside your own storage: the
column keeps a hash, and get_token and list_tokens can never return it.
Hand it over or store it the moment you read it.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. It reaches beyond Subscriby: a connector, a provider or a member.
Arguments
name*stringA label for the token, up to 255 characters, shown on Settings under API Tokens.
abilities*arrayThe abilities the token holds, at least one, each a value from the ability catalog resource. Must be a subset of what the calling token holds; "token:create" is never granted this way.
team_id*stringUUID of the team the token is minted for; it becomes the token's frozen scope and must be a team the caller owns or belongs to.
How it fails
VALIDATION_FAILEDan ability the caller does not hold, token:create asked for, a retired ability (the refusal names its replacements), a team that is not the caller's, or a malformed payload.
TOKEN_MISSING_ABILITYtoken lacks token:create.
Arguments
name(required) — a label, up to 255 characters, shown on Settings under API Tokens.abilities(required) — at least one ability value from the ability catalog resource, each held by the calling token.team_id(required) — UUID of the team the token is minted for.
How is this guide?
Last updated on