Issues a token and returns its secret, once.
Errors
401 when nothing was signed in, 403 when authenticated with a token
and not a session, 400 when the name or lifetime is unusable.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of POST /tokens.
expires_in_days?|How long the token should last, in days. Omit for a token that lives until it is revoked.
int320 <= valuename*stringA label for the token, so its owner can recognise it later.
permissions?array<string>|What the token may do, as resource:verb strings.
Omitted means shares:create and nothing else, since a token exists to
upload, and a default that errs safe has to be widened explicitly. The
other default would hand every screenshot tool the ability to delete
everything its owner has.
A permission the caller does not hold is refused: a token cannot be a way to exceed the account that minted it.
Issued; the secret is shown only here
application/json- response
A newly issued token. The only response that ever carries the secret.
created_at*stringWhen it was issued, RFC 3339.
display_prefix*stringLeading characters of the secret, so a person can tell two tokens apart without the service having to store either of them.
expires_at?|When it stops being accepted, or null to live until revoked.
id*stringStable identifier; what DELETE /tokens/{id} takes.
last_used_at?|When it was last accepted, if ever.
name*stringWhat the owner called it.
permissions*array<string>What it may do, as resource:verb strings.
What it was minted with, not what it can do right now. Those differ when the owner has since been demoted, and the owner is who this list is for. Sending the narrowed set instead would make a token look as though it had been quietly edited.
revoked_at?|When it was revoked, if it was.
secret*stringThe secret, in full.
Shown once. Only its SHA-256 digest is stored, so this value cannot be recovered, so a client that does not keep it must issue another token.
curl -X POST 'https://example.com/api/v1/tokens' \ -H 'Content-Type: application/json' \ -d '{ "name": "string"}'{ "created_at": "string", "display_prefix": "string", "expires_at": "string", "id": "string", "last_used_at": "string", "name": "string", "permissions": [ "string" ], "revoked_at": "string", "secret": "string"}