Create a service account token
POST/serviceAccounts/{serviceAccountId}/tokens
Base URL: https://api.tinkermode.com
Create a new token for the service account. The raw token secret is returned exactly once in this response and is never stored or returned again. A service account holds at most 2 active tokens. When creating a token would exceed that cap, the oldest active token is evicted.
Authentication
Send an Authorization header of the form ModeCloud <AUTH_CODE>.
Must contain a user API key for a project super admin or a project API key with "Admin" privileges.
Path parameters
| Name | Type | Required | Constraints | Description |
|---|---|---|---|---|
serviceAccountId | integer | Yes | The unique ID for a specified service account. |
Request body
Content type: application/json
| Property | Type | Required | Constraints | Description |
|---|---|---|---|---|
expiresAt | string | No | Optional time the token expires, in RFC3339 format. Must be in the future. If omitted, the token does not expire. |
Responses
201 Successfully created a new token. The raw token secret is returned exactly once.
Content type: application/json
| Property | Type | Required | Constraints | Description | ||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
metadata | object | Yes | Stored metadata for a single service account token. The raw token secret is never persisted or returned in this record. Only a short display suffix is kept. | |||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||
token | string | Yes | read-only (server-generated) | Raw token secret. Returned exactly once at creation and never again. Send it in the Authorization header. It is rejected if presented in a query string. | ||||||||||||||||||||||||||||||||||||||||
Response example
{
"metadata": {
"createdAt": "2026-06-01T00:00:00.000Z",
"id": 100,
"projectId": 1234,
"serviceAccountId": 7,
"status": "active",
"suffix": "a9b65a"
},
"token": "v1.c2F8MTIzNHwxMDA=.1780509470.a8aeb78fd720c11ec8b6bf7976d8f9d27e95cf7dfacea29a7ea9b65a"
}401 Authorization is required to access this resource.
Content type: application/json
| Property | Type | Required | Constraints | Description |
|---|---|---|---|---|
data | object | No | read-only (server-generated) | Any relevant data related to error. |
reason | string | Yes | read-only (server-generated) | Reason of error. |
403 Request failed because of invalid data or denied permission.
Content type: application/json
| Property | Type | Required | Constraints | Description |
|---|---|---|---|---|
data | object | No | read-only (server-generated) | Any relevant data related to error. |
reason | string | Yes | read-only (server-generated) | Reason of error. |
429 Request failed because of rate limit.
Content type: application/json
| Property | Type | Required | Constraints | Description |
|---|---|---|---|---|
data | object | No | read-only (server-generated) | Any relevant data related to error. |
reason | string | Yes | read-only (server-generated) | Reason of error. |
500 An unexpected error has occurred.
Content type: application/json
| Property | Type | Required | Constraints | Description |
|---|---|---|---|---|
data | object | No | read-only (server-generated) | Any relevant data related to error. |
reason | string | Yes | read-only (server-generated) | Reason of error. |
503 The service is temporarily unavailable.
Content type: application/json
| Property | Type | Required | Constraints | Description |
|---|---|---|---|---|
data | object | No | read-only (server-generated) | Any relevant data related to error. |
reason | string | Yes | read-only (server-generated) | Reason of error. |