# Make a token

> tidekeeper's API reference: https://tidekeeper.eu/docs/api/post-tokens

`POST /api/v1/tokens`

Make a token: what it may do, and on which sites. It is in this answer once; only its hash is kept.

## What to send

`TokenCreate`

- `expires_days` (integer or null): Days until it stops working. Left out, it does not.
- `name` (string, needed)
- `scopes` (list of string): `read`, `events`, `manage`, `visitors`.
- `sites` (list of string): Site ids or names it is held to. Empty is every site its maker may open.

## The answer

201, `TokenCreated`: The only time a token's secret is shown.

- `secret` (string, needed)
- `token` (TokenView, needed)

## Asking

```sh
curl -X POST https://tidekeeper.eu/api/v1/tokens \
    -H "Authorization: Bearer $TIDEKEEPER_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"name": "…"}'
```