Generate a token

Mints a token by type and answers 201 with it (shown only here):

• user: a user token, limited by permissions (by default everything you can do).
• realm: a realm token for daemons of realm_ids (you must be a member of each).
• a2a: the A2A token of realm_id, replacing the previous one (realm admin).
• daemon_wire: a short-lived dispatch token for realm_id, optionally for one run_id and action.

Requires a signed-in user token (Authorization: Bearer cliq_tok_…). Results are limited to what that user can see. Cannot mint wider than the calling token.

POST /v1/auth/generate_token

cURL

user

curl --request POST \ --url https://{host}/v1/auth/generate_token \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data ' { "type": "user", "name": "ci-runner", "permissions": { "domains": { "realms": [ "5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b" ] }, "access": { "runs": [ "read", "write" ], "teams": [ "read" ] } } } '

201

user

{ "ok": true, "data": { "token": "cliq_tok_4f9a…", "name": "ci-runner", "id": "42", "realm_ids": [ "5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b" ] } }

Authorizations

Authorization · string · header · required

User PAT (cliq_tok_…, including session-scoped) or realm token (cliq_dt_…).

Body

application/json

type · enum<string> · required

user → cliq_tok_…; realm → cliq_dt_…; a2a → cliq_a2a_…; daemon_wire → short-lived RS256

Available options: user, realm, a2a, daemon_wire

name · string

Label shown in your token list. Up to 100 characters.

Maximum string length: 100

realm_ids · string[]

Required for type=realm (non-empty). User tokens omit this.

Minimum array length: 1

Minimum string length: 1

realm_id · string

a2a and daemon_wire: the realm.

Minimum string length: 1

aud · string

daemon_wire: the daemon the token is for.

run_id · string

daemon_wire: limit the token to this run.

action · enum<string>

daemon_wire: execute, cancel or access.

Available options: execute, cancel, access

permissions · object

user and realm: what the token may do (domains: orgs and realms; access: read, write or admin per resource).

Show child attributes

Response

201

application/json

The new token. user: { token, name, id, realm_ids }; realm: same; a2a: { type, token, bearer, realm_id, has_bearer, bearer_prefix }; daemon_wire: { type, token, expires_in, realm_id }.

ok · enum<boolean> · required

Always true on success.

Available options: true

data · object · required

Show child attributes