token.create
bearer
Create a personal access token
Mints a personal access token (PAT) for scripts and other apps. The plaintext secret (prefix pnt_) is returned ONCE and only a hash is stored. A PAT is sent like an access token (Authorization: Bearer pnt_…), never expires unless you set expires_at, and may call only the image.* namespace plus the upload/archive HTTP routes. JWT session only.
Parameters
Passed by name in the params object.
| Name | Type | Required | Description |
|---|---|---|---|
current_password |
string | yes | The caller's current password (re-authentication) |
name |
string | yes | A human label for the token |
expires_at |
string | no | Optional RFC3339 expiry; omit for a token that never expires |
Result
Returns createTokenResult:
| Field | Type | Description |
|---|---|---|
created_at * |
string | RFC3339 creation timestamp |
expires_at |
string | RFC3339 expiry, if the token expires |
hint * |
string | First 10 characters of the secret (pnt_ + 6), to identify it |
id * |
string | Token UUID |
last_used_at |
string | RFC3339 timestamp of last use (throttled), if ever used |
name * |
string | Human label given at creation |
token * |
string | The plaintext secret (prefix pnt_) — shown only once; store it now |
Errors
| Code | Message | When |
|---|---|---|
2002 |
validation_failed |
Malformed request; see error.data. |
See the error reference for the full catalog, including the authentication codes.
Example
Request:
{
"jsonrpc": "2.0",
"id": 1,
"method": "token.create",
"params": {
"current_password": "correct-horse-battery-staple",
"name": "backup-script",
"expires_at": "2027-01-01T00:00:00Z"
}
}
Response:
{
"jsonrpc": "2.0",
"id": 1,
"result": {
"token": "pnt_3f9a2c7d8e1b4a6f0c5d9e2a7b3c1f8e",
"id": "018f3a8e-3c9d-7a2b-b5e6-7f8a9b0c1d2e",
"name": "backup-script",
"hint": "pnt_3f9a",
"expires_at": "2027-01-01T00:00:00Z",
"created_at": "2026-03-14T09:26:53Z"
}
}
curl
curl -s https://peinture.gumeniuk.com/rpc \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"token.create","params":{"current_password":"correct-horse-battery-staple","name":"backup-script","expires_at":"2027-01-01T00:00:00Z"}}'
JavaScript
const res = await fetch("https://peinture.gumeniuk.com/rpc", {
method: "POST",
headers: {
"Content-Type": "application/json",
"Authorization": `Bearer ${token}`,
},
body: JSON.stringify({
jsonrpc: "2.0", id: 1, method: "token.create", params: {"current_password":"correct-horse-battery-staple","name":"backup-script","expires_at":"2027-01-01T00:00:00Z"},
}),
});
const { result, error } = await res.json();
Go
body := []byte(`{"jsonrpc":"2.0","id":1,"method":"token.create","params":{"current_password":"correct-horse-battery-staple","name":"backup-script","expires_at":"2027-01-01T00:00:00Z"}}`)
req, _ := http.NewRequest("POST", "https://peinture.gumeniuk.com/rpc", bytes.NewReader(body))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer "+token)
resp, err := http.DefaultClient.Do(req)