Description

Create a new API token. The id field of the returned token is the bearer string.

Authentication

This endpoint requires a Bearer token in the Authorization header.

• Authorization: Bearer <token>. A valid Portal API session token or API token.

Request Body

The request body should be JSON-encoded.

• name: A human-readable label for the token. Used in the admin UI to distinguish tokens.
• restrictions (Optional): An object describing limits on how the token can be used.

Restrictions

The restrictions object accepts the following fields:

• hosts: An array of hostnames the token is allowed to be used from. The hostname is matched exactly against the Origin header of incoming requests.

Response Schema

On success, the endpoint returns the newly created token record. The shape matches an entry from List API Tokens.

Error Responses

• 401 Unauthorized: The Authorization header is missing or the token is not valid.

Example Request
POST https://<your-host>:9909/api/portal/v1/apiTokens
Authorization: Bearer <token>
Content-Type: application/json

{
    "name": "Production Token",
    "restrictions": {
        "hosts": ["example.com"]
    }
}

Example Response
Status Code: 200 OK
Response Body:
{
    "id": "299ce9bf4f244300a96f3926240f9c0d",
    "name": "Production Token",
    "userId": 1,
    "userEmail": "example@zydromarine.com",
    "createdAt": 1736942400000,
    "lastUsedAt": null,
    "restrictions": {
        "hosts": ["example.com"]
    }
}