Issue an API token

curl -X POST http://localhost:5080/api/v1/auth/tokens \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "grafana-readonly",
    "role_id": "<viewer-role-id>",
    "expires_in_days": 90
  }'

{
  "id": "3KE5hOsEc3lMC9qr9RWnPn0pqWF",
  "prefix": "l2XcQd8UoQzK3pLm",
  "token": "ms_l2XcQd8UoQzK3pLm_<secret>",
  "role_id": "<viewer-role-id>",
  "role_key": "viewer",
  "role_name": "Viewer",
  "token_kind": "personal",
  "application_id": null,
  "service_account_id": null,
  "expires_at_micros": 1798000000000000,
  "created_at_micros": 1790000000000000
}

curl -X POST http://localhost:5080/api/v1/auth/tokens \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "grafana-readonly",
    "role_id": "<viewer-role-id>",
    "expires_in_days": 90
  }'

{
  "id": "3KE5hOsEc3lMC9qr9RWnPn0pqWF",
  "prefix": "l2XcQd8UoQzK3pLm",
  "token": "ms_l2XcQd8UoQzK3pLm_<secret>",
  "role_id": "<viewer-role-id>",
  "role_key": "viewer",
  "role_name": "Viewer",
  "token_kind": "personal",
  "application_id": null,
  "service_account_id": null,
  "expires_at_micros": 1798000000000000,
  "created_at_micros": 1790000000000000
}

POST /api/v1/auth/tokens

Creates a long-lived token of the form ms_<prefix>_<secret>. The response is the only time that the plaintext token appears, so store it immediately. The call requires the permission api_tokens.manage in an organization scope. Body

Field	Type	Required	Notes
`name`	string	Yes	Display name. Must not be empty.
`role_id`	string	No	Organization role of the token. Defaults to the built-in Intake token role, which holds only `streams.write` and `apm.deploy`. The role cannot hold a permission that the caller lacks. The `rum_client` role is rejected. Omit the field when `service_account_id` is set.
`service_account_id`	string	No	Issues the token for a service account. The token inherits the role of the account. A disabled account is rejected.
`expires_in_days`	integer	No	Lifetime in days, limited to 1 through 1825. Omit the field for a token that never expires.

curl -X POST http://localhost:5080/api/v1/auth/tokens \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "grafana-readonly",
    "role_id": "<viewer-role-id>",
    "expires_in_days": 90
  }'

{
  "id": "3KE5hOsEc3lMC9qr9RWnPn0pqWF",
  "prefix": "l2XcQd8UoQzK3pLm",
  "token": "ms_l2XcQd8UoQzK3pLm_<secret>",
  "role_id": "<viewer-role-id>",
  "role_key": "viewer",
  "role_name": "Viewer",
  "token_kind": "personal",
  "application_id": null,
  "service_account_id": null,
  "expires_at_micros": 1798000000000000,
  "created_at_micros": 1790000000000000
}

List the role ids with GET /api/v1/roles. The built-in organization roles are owner, admin, editor, viewer, and intake. Send the token like a login token: Authorization: Bearer ms_…. A token with the default role can send data and cannot query it. Errors

Status	Cause
`400`	Empty `name`, a `rum_client` role, or a `role_id` together with `service_account_id`.
`403`	The role holds permissions that the caller lacks, or the caller lacks `api_tokens.manage`.
`404`	The system scope has no API tokens, or the role or the service account does not exist.

Last modified on October 26, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration