Skip to main content

Create a personal API token

POST 
/users/:username/tokens

Required role: admin. Only an account or token with the admin role can call this operation.

Example request
curl --request POST \
  --header "Authorization: Bearer $HOSERVA_TOKEN" \
  --header "Content-Type: application/json" \
  --data @body.json \
  "https://$HOSERVA_HOST:8008/api/v1/users/{username}/tokens"

A personal API token, scoped to admin or viewer, for scripting and the remote CLI over TCP. The raw token is returned only here, once — only its SHA-256 is ever stored afterward, mirroring how a session cookie is handled. Refused for a share-only account (share-only has no API access at all), and refused when role exceeds the account's own role: a token can narrow an account's access (an admin can hand out a viewer-scoped token to reduce a script's own blast radius), never widen it.

Request​

Responses​

The new token, with its raw value shown once.