> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trelent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate tokens

> Create new access tokens with scoped permissions and configurable expiration.

Generate a new JWT access token with specific permissions. The calling token must have `token:generate` or `token:*` permission, and can only grant permissions it already holds.

## Request parameters

<ParamField body="subject" type="string" required>
  Identifier for the token subject (e.g., service name, user ID).
</ParamField>

<ParamField body="permissions" type="array<string>" required>
  Set of permission scopes to grant. See [available permissions](/data-ingestion/tokens#available-permissions).
</ParamField>

<ParamField body="name" type="string">
  Optional human-readable name for the token.
</ParamField>

<ParamField body="expires_seconds" type="integer" default="3600">
  Token lifetime in seconds. Defaults to 1 hour.
</ParamField>

<ParamField body="audiences" type="array<string>">
  Optional list of intended audiences for the token.
</ParamField>

<ParamField body="not_before_seconds" type="integer">
  Optional delay before the token becomes valid.
</ParamField>

## Generate a token

<Tabs>
  <Tab title="TypeScript">
    ```ts theme={null}
    // TODO: Add TypeScript SDK example for token generation
    ```
  </Tab>

  <Tab title="Python">
    ```python theme={null}
    # TODO: Add Python SDK example for token generation
    ```
  </Tab>

  <Tab title="cURL">
    ```bash theme={null}
    curl -X POST "${API_URL}/v1/token/generate" \
      -H "Authorization: Bearer ${API_TOKEN}" \
      -H "Content-Type: application/json" \
      -d '{
        "subject": "my-service",
        "permissions": ["workflow:document", "file:upload"],
        "expires_seconds": 86400
      }'
    ```
  </Tab>
</Tabs>

<ResponseExample>
  ```json 200 OK theme={null}
  {
    "token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
    "jti": "550e8400-e29b-41d4-a716-446655440000"
  }
  ```
</ResponseExample>

## Response fields

<ResponseField name="token" type="string">
  The signed JWT to use in `Authorization: Bearer` headers.
</ResponseField>

<ResponseField name="jti" type="string">
  Unique token identifier (JWT ID). Use this to revoke the token later.
</ResponseField>

<Warning>
  Store the returned token securely. It cannot be retrieved again after generation.
</Warning>