> ## Documentation Index > Fetch the complete documentation index at: https://docs.blips.network/llms.txt > Use this file to discover all available pages before exploring further. # Create an API token for your authenticated platform. > Create one API token for your authenticated platform. The request body requires a `name` plus at least one permission from `view` or `manage`. The operator-issued root manage token remains visible but is not created here. `clientSecret` is returned once on create only. ## OpenAPI ````yaml /openapi/blips-public-reference.yaml post /tokens openapi: 3.1.0 info: title: BLIPS Public Reference API version: '2026-04-08' description: >- Public OpenAPI 3.1 subset for the first BLIPS Mintlify API Reference and Playground release. This document is bound to the confirmed Public Test Backend at https://public-test.blips.network, includes only the approved first-release public endpoints, uses only internal `$ref` values, and excludes callback-only webhook documentation and operator-only surfaces. servers: - url: https://public-test.blips.network description: >- Confirmed Public Test Backend ingress target for public BLIPS API Reference, Playground, and internet-testable Try It flows. security: - BasicAuth: [] tags: - name: Platform Setup description: >- Bootstrap and platform configuration surfaces for establishing the public BLIPS integration context. - name: Sandbox API description: >- Sandbox-only externally displayed helper surfaces. These routes either adjust quote inputs or create incoming-payment review cases, but they always feed the existing quote or transaction families and never become second outward API families. - name: Tokens description: >- Platform-scoped API credential create, list, detail, and revoke operations. - name: Customers description: >- Customer onboarding, profile lifecycle, and PPV payment-address issuance surfaces. - name: Accounts description: >- Customer-bound internal-account and external-account surfaces kept in the first-layer public contract. - name: Same-Currency Transfers description: >- Same-currency receiver lookup plus incoming and outgoing transfer primitives. - name: Cross-Currency Transfers description: >- PPV-first receiver lookup, quote creation/readback, and quote execution for cross-currency flows. - name: Transactions description: Transaction readback plus bounded incoming-review decision operations. - name: Webhooks description: >- Webhook connectivity verification surface for the public BLIPS integration. paths: /tokens: post: tags: - Tokens summary: Create an API token for your authenticated platform. description: >- Create one API token for your authenticated platform. The request body requires a `name` plus at least one permission from `view` or `manage`. The operator-issued root manage token remains visible but is not created here. `clientSecret` is returned once on create only. operationId: createApiToken requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/TokenCreateMvpRequest' examples: default: value: name: Demo readback token permissions: - view responses: '201': description: API token created. Client secret returned only on create. content: application/json: schema: $ref: '#/components/schemas/TokenCreateMvpResponse' examples: default: value: id: Token:tok_51ce4ab09d87 name: Demo readback token permissions: - view accessLevel: view_only issuerType: platform_self_service status: ACTIVE revocable: true clientId: ik_test_7fa9f566c2f1467ab03d1f65 clientSecret: iksec_test_0f09acb6536a43f8b90d4ae209f2f9d39f61b7f6 createdAt: '2026-04-12T08:15:00Z' updatedAt: '2026-04-12T08:15:00Z' revokedAt: null '400': description: Invalid token creation fields or unsupported fields supplied. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: invalidInput: value: status: 400 code: INVALID_REQUEST message: Invalid token creation fields. details: permissions: 'unsupported permission(s): transact' '401': description: Invalid or missing API credentials. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: unauthorized: value: status: 401 code: UNAUTHORIZED message: Invalid or missing API credentials. details: {} '403': description: Authenticated token is not allowed to perform manage actions. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: forbidden: value: status: 403 code: FORBIDDEN message: Manage access required. details: requiredAccessLevel: manage '500': description: Internal service error. content: application/json: schema: $ref: '#/components/schemas/TokenDetailErrorResponse' examples: internalServiceError: value: status: 500 code: INTERNAL_ERROR message: Internal service error. details: {} security: - BasicAuth: [] components: schemas: TokenCreateMvpRequest: type: object additionalProperties: false required: - name - permissions properties: name: type: string description: Human-readable API token label. permissions: type: array minItems: 1 description: >- One or more public permissions to grant to the token. `view` and `manage` are the only published values. items: $ref: '#/components/schemas/TokenPermission' TokenCreateMvpResponse: type: object additionalProperties: false required: - id - name - permissions - accessLevel - issuerType - status - revocable - clientId - clientSecret - createdAt - updatedAt - revokedAt properties: id: type: string description: Stable public API-key identifier in `Token:` form. name: type: string description: Human-readable API-key label. permissions: type: array description: >- Public permissions granted to this token. Legacy runtime scopes are projected into this bounded public pair. items: $ref: '#/components/schemas/TokenPermission' accessLevel: type: string enum: - management - view_only description: >- Compatibility access-level projection. Tokens that include `manage` read back as `management`; tokens without it read back as `view_only`. issuerType: type: string enum: - operator_issued - platform_self_service description: >- Whether the token is the operator-issued root manage token or a platform-created token. status: type: string description: Current key lifecycle state returned by runtime readback. revocable: type: boolean description: >- Whether Platform Config may revoke this token. The operator-issued root manage token returns `false`. clientId: type: string description: Client identifier used for Basic Auth. clientSecret: type: string description: >- Client secret shown once at token creation time. It is not re-readable later. createdAt: type: string format: date-time description: API-key creation timestamp. updatedAt: type: string format: date-time description: Most recent API-key update timestamp. revokedAt: type: - string - 'null' format: date-time description: Revocation timestamp. `null` while the key is still active. TokenDetailErrorResponse: type: object additionalProperties: false required: - status - code - message - details properties: status: type: integer description: HTTP status code returned for the failed token request. code: type: string description: Stable public error code for the failed token request. message: type: string description: Human-readable summary of the token request failure. details: type: object additionalProperties: true description: >- Additional structured error context when the token request exposes one. TokenPermission: type: string enum: - view - manage description: >- Public API token permission. `view` covers read access and `manage` covers token-management and other privileged platform actions. securitySchemes: BasicAuth: type: http scheme: basic description: >- Integration-key Basic Auth (`clientId:clientSecret`) as documented in docs/public/AUTHENTICATION.md. ````