Skip to content
DYCRYPT

Mint a token

POST
/api/tokens
curl --request POST \
  --url https://app.dycrypt.com/o/acme/api/tokens \
  --header 'Content-Type: application/json' \
  --cookie JSESSIONID=<JSESSIONID> \
  --data '{ "name": "example", "scopes": [ "licenses:read" ], "expiresOn": "2026-04-15" }'

The response carries secret, and it is the only time it ever will — nothing stores it, so a lost token is replaced, not recovered.

Closed to tokens. A token that could mint tokens could grant itself every capability, which would make the whole model advisory. The ceiling on a token has to be set by a person.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
name
required
string
scopes
required
Array<string>
Allowed values: licenses:read licenses:write products:read products:write customers:read customers:write users:read users:write analytics:read activity:read
expiresOn

Absent for a token that lasts until revoked.

string format: date

Responses

Section titled “Responses”

200

Section titled “200”

The new token, including its secret.

Media typeapplication/json
object
id
integer format: int64
tokenId

The public half of the credential — the <id> in dyc_<id>_<secret>.

string
name
string
scopes
Array<string>
Allowed values: licenses:read licenses:write products:read products:write customers:read customers:write users:read users:write analytics:read activity:read
status
string
Allowed values: ACTIVE EXPIRED REVOKED
expiresAt
string | null format: date-time
lastUsedAt

Stamped at most once a minute, so a dead integration is visible without turning every read into a write.

string | null format: date-time
revokedAt
string | null format: date-time
createdAt
string format: date-time
createdBy
string
secret

Shown once.

string
Example
{
  "scopes": [
    "licenses:read"
  ],
  "status": "ACTIVE"
}

400

Section titled “400”

The request is wrong — a bad date, a missing field, a value the product does not declare.

Media typeapplication/json

Every failure in this API has this shape and no other.

object
error
required
string
Example
{
  "error": "this token does not have licenses:write"
}

401

Section titled “401”

No credential, or one that no longer resolves — revoked, expired, deleted. Replace it.

Media typeapplication/json

Every failure in this API has this shape and no other.

object
error
required
string
Example
{
  "error": "this token does not have licenses:write"
}

403

Section titled “403”

Not available to API tokens, or the caller is not an organisation administrator.

Media typeapplication/json

Every failure in this API has this shape and no other.

object
error
required
string
Example
{
  "error": "this token does not have licenses:write"
}