> ## Documentation Index
> Fetch the complete documentation index at: https://sourcebot-sou-1870-scoped-access-tokens.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a scoped access token

> Creates an opaque bearer token that expires exactly one hour after issuance and is restricted to the requested repositories. Repository IDs are validated atomically against the API-key owner's current access; the request fails if any ID is missing or inaccessible. Repository IDs are returned by GET /api/repos.

This endpoint requires a Sourcebot API key. Scoped access tokens, OAuth tokens, and browser sessions cannot mint another scoped access token. The returned token is independent of the API key after issuance and cannot be refreshed.



## OpenAPI

````yaml /api-reference/sourcebot-public.openapi.json post /api/ee/scoped_access_token
openapi: 3.0.3
info:
  title: Sourcebot Public API
  version: v5.1.5
  description: >-
    OpenAPI description for the public Sourcebot REST endpoints used for search,
    repository listing, and file browsing. Authentication is instance-dependent:
    API keys are the standard integration mechanism, OAuth bearer tokens are
    EE-only, and some instances may allow anonymous access.
servers: []
security:
  - bearerToken: []
  - apiKeyHeader: []
  - {}
tags:
  - name: Search & Navigation
    description: Code search and symbol navigation endpoints.
  - name: Repositories
    description: Repository listing and metadata endpoints.
  - name: Git
    description: Git history, diff, and file content endpoints.
  - name: Scoped Access Tokens
    description: >-
      Mint and revoke short-lived credentials restricted to specific
      repositories.
  - name: System
    description: System health and version endpoints.
  - name: Enterprise (EE)
    description: Enterprise endpoints for user management and audit logging.
paths:
  /api/ee/scoped_access_token:
    post:
      tags:
        - Scoped Access Tokens
      summary: Create a scoped access token
      description: >-
        Creates an opaque bearer token that expires exactly one hour after
        issuance and is restricted to the requested repositories. Repository IDs
        are validated atomically against the API-key owner's current access; the
        request fails if any ID is missing or inaccessible. Repository IDs are
        returned by GET /api/repos.


        This endpoint requires a Sourcebot API key. Scoped access tokens, OAuth
        tokens, and browser sessions cannot mint another scoped access token.
        The returned token is independent of the API key after issuance and
        cannot be refreshed.
      operationId: createScopedAccessToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PublicCreateScopedAccessTokenRequest'
      responses:
        '201':
          description: >-
            Scoped access token created. The opaque token value is returned only
            in this response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicCreateScopedAccessTokenResponse'
        '400':
          description: Invalid request body or repository scope.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiServiceError'
        '401':
          description: Missing or invalid authentication.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiServiceError'
        '403':
          description: >-
            The current authentication method is not an API key, or the API-key
            owner is not permitted to perform this operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiServiceError'
        '500':
          description: Unexpected token creation failure.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiServiceError'
      security:
        - bearerToken: []
        - apiKeyHeader: []
components:
  schemas:
    PublicCreateScopedAccessTokenRequest:
      type: object
      properties:
        repoIds:
          type: array
          items:
            type: integer
            minimum: 0
            exclusiveMinimum: true
          minItems: 1
          description: >-
            Repository IDs to bind to the token. Every ID must identify a
            repository accessible to the API-key owner.
      required:
        - repoIds
      additionalProperties: false
    PublicCreateScopedAccessTokenResponse:
      type: object
      properties:
        id:
          type: string
          description: Identifier used to revoke the token.
        token:
          type: string
          pattern: ^sbst_
          description: >-
            Opaque bearer token. This value is returned only when the token is
            created.
        createdAt:
          type: string
          format: date-time
        expiresAt:
          type: string
          format: date-time
        repoIds:
          type: array
          items:
            type: integer
            minimum: 0
            exclusiveMinimum: true
          minItems: 1
      required:
        - id
        - token
        - createdAt
        - expiresAt
        - repoIds
    PublicApiServiceError:
      type: object
      properties:
        statusCode:
          type: number
        errorCode:
          type: string
        message:
          type: string
      required:
        - statusCode
        - errorCode
        - message
      description: Structured error response returned by Sourcebot public API endpoints.
  securitySchemes:
    bearerToken:
      type: http
      scheme: bearer
      description: >-
        Bearer authentication header of the form `Bearer <token>`. The token may
        be a Sourcebot API key, OAuth access token, or scoped access token,
        subject to endpoint requirements.
    apiKeyHeader:
      type: apiKey
      in: header
      name: X-Sourcebot-Api-Key
      description: >-
        Header of the form `X-Sourcebot-Api-Key: <token>`, where `<token>` is
        your API key.

````