> ## Documentation Index > Fetch the complete documentation index at: https://docs.getcliq.io/llms.txt > Use this file to discover all available pages before exploring further. # Generate a token > Mints a token by `type` and answers `201` with it (shown only here): - `user`: a user token, limited by `permissions` (by default everything you can do). - `realm`: a realm token for daemons of `realm_ids` (you must be a member of each). - `a2a`: the A2A token of `realm_id`, replacing the previous one (realm admin). - `daemon_wire`: a short-lived dispatch token for `realm_id`, optionally for one `run_id` and `action`. Requires a signed-in user token (`Authorization: Bearer cliq_tok_…`). Results are limited to what that user can see. Cannot mint wider than the calling token. ## OpenAPI ````yaml /openapi/hub-by-tag/hub-auth.yaml post /v1/auth/generate_token openapi: 3.0.3 info: title: 'CliqHub API: Auth' version: 1.0.0 description: >- API tokens. Every call to CliqHub carries one as `Authorization: Bearer `: - **User token** (`cliq_tok_…`): acts as you, optionally limited by `permissions` (which organizations and realms, and read / write / admin per kind of resource). `cliq login` stores one; mint more for scripts and CI. - **Realm token** (`cliq_dt_…`): what a daemon uses to join and work in a realm. Any member of the realm can mint one. - **A2A token** (`cliq_a2a_…`): what outside agents send to a realm's A2A endpoint. One per realm; minting a new one replaces the old. - **Dispatch token**: a short-lived signed token CliqHub uses when it sends work to a daemon; each realm has a dispatch key pair for it. A token is shown only when it is minted or rotated. A restricted token cannot mint a token wider than itself. servers: - url: https://{host} variables: host: default: cliqhub.io description: CliqHub host security: [] tags: - name: Auth description: >- API tokens. Every call to CliqHub carries one as `Authorization: Bearer `: - **User token** (`cliq_tok_…`): acts as you, optionally limited by `permissions` (which organizations and realms, and read / write / admin per kind of resource). `cliq login` stores one; mint more for scripts and CI. - **Realm token** (`cliq_dt_…`): what a daemon uses to join and work in a realm. Any member of the realm can mint one. - **A2A token** (`cliq_a2a_…`): what outside agents send to a realm's A2A endpoint. One per realm; minting a new one replaces the old. - **Dispatch token**: a short-lived signed token CliqHub uses when it sends work to a daemon; each realm has a dispatch key pair for it. A token is shown only when it is minted or rotated. A restricted token cannot mint a token wider than itself. paths: /v1/auth/generate_token: post: tags: - Auth summary: Generate a token description: >- Mints a token by `type` and answers `201` with it (shown only here): - `user`: a user token, limited by `permissions` (by default everything you can do). - `realm`: a realm token for daemons of `realm_ids` (you must be a member of each). - `a2a`: the A2A token of `realm_id`, replacing the previous one (realm admin). - `daemon_wire`: a short-lived dispatch token for `realm_id`, optionally for one `run_id` and `action`. Requires a signed-in user token (`Authorization: Bearer cliq_tok_…`). Results are limited to what that user can see. Cannot mint wider than the calling token. operationId: POST_v1_auth_generate_token requestBody: required: true content: application/json: schema: type: object properties: type: type: string enum: - user - realm - a2a - daemon_wire description: >- `user` → cliq_tok_…; `realm` → cliq_dt_…; `a2a` → cliq_a2a_…; `daemon_wire` → short-lived RS256 name: type: string maxLength: 100 description: Label shown in your token list. Up to 100 characters. realm_ids: type: array items: type: string minLength: 1 minItems: 1 description: Required for type=realm (non-empty). User tokens omit this. realm_id: type: string minLength: 1 description: '`a2a` and `daemon_wire`: the realm.' aud: type: string description: '`daemon_wire`: the daemon the token is for.' run_id: type: string description: '`daemon_wire`: limit the token to this run.' action: type: string enum: - execute - cancel - access description: '`daemon_wire`: `execute`, `cancel` or `access`.' permissions: type: object properties: domains: type: object properties: orgs: oneOf: - type: string enum: - '*' - description: >- Unsupported Zod expression `// Org ids are UUIDs; integers kept for legacy clients (B6). z.array(z.union([z.string().min(1), z.number().int(), z` type: object additionalProperties: true description: >- Org ids where this credential may act, or `*` for all orgs the subject can reach realms: oneOf: - type: string enum: - '*' - type: array items: oneOf: - type: string minLength: 1 - type: string enum: - '*' minItems: 1 description: Realm ids where this credential may act, or `*` access: type: object properties: users: type: array items: type: string enum: - read - write - admin minItems: 1 orgs: type: array items: type: string enum: - read - write - admin minItems: 1 scopes: type: array items: type: string enum: - read - write - admin minItems: 1 description: >- Manage the Hub scopes catalog (create/update/delete package namespaces). teams: type: array items: type: string enum: - read - write - admin minItems: 1 drafts: type: array items: type: string enum: - read - write - admin minItems: 1 tokens: type: array items: type: string enum: - read - write - admin minItems: 1 realms: type: array items: type: string enum: - read - write - admin minItems: 1 daemons: type: array items: type: string enum: - read - write - admin minItems: 1 runs: type: array items: type: string enum: - read - write - admin minItems: 1 dispatch: type: array items: type: string enum: - read - write - admin minItems: 1 workspaces: type: array items: type: string enum: - read - write - admin minItems: 1 agents: type: array items: type: string enum: - read - write - admin minItems: 1 settings: type: array items: type: string enum: - read - write - admin minItems: 1 notifications: type: array items: type: string enum: - read - write - admin minItems: 1 builder: type: array items: type: string enum: - read - write - admin minItems: 1 hug: type: array items: type: string enum: - read - write - admin minItems: 1 reports: type: array items: type: string enum: - read - write - admin minItems: 1 description: >- Per-entity levels: read (get/list), write (create/update/dispatch), admin (destructive tenancy) auto_enrolled: type: boolean description: Set by daemon bootstrap mint — revoked on `cliq logout`. description: >- `user` and `realm`: what the token may do (`domains`: orgs and realms; `access`: read, write or admin per resource). required: - type examples: user: summary: A user token for CI value: type: user name: ci-runner permissions: domains: realms: - 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b access: runs: - read - write teams: - read realm: summary: A realm token for a daemon value: type: realm name: build-01 realm_ids: - 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b responses: '201': description: >- The new token. `user`: `{ token, name, id, realm_ids }`; `realm`: same; `a2a`: `{ type, token, bearer, realm_id, has_bearer, bearer_prefix }`; `daemon_wire`: `{ type, token, expires_in, realm_id }`. content: application/json: schema: type: object required: - ok - data properties: ok: type: boolean enum: - true description: Always `true` on success. data: type: object required: - token properties: token: type: string description: The token. Store it now; it is not shown again. type: type: string enum: - a2a - daemon_wire description: Present for `a2a` and `daemon_wire`. id: type: string description: 'user, realm: the token id (to rotate or revoke it).' name: type: string realm_ids: type: array items: type: string realm_id: type: string bearer: type: string description: 'a2a: same as `token`.' has_bearer: type: boolean bearer_prefix: type: string expires_in: type: number description: 'daemon_wire: seconds until it expires.' examples: user: summary: user value: ok: true data: token: cliq_tok_4f9a… name: ci-runner id: '42' realm_ids: - 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b realm: summary: realm value: ok: true data: token: cliq_dt_Xk3… id: '43' name: build-01 realm_ids: - 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b '401': description: >- `unauthorized`: No `Authorization` header, or the token is malformed, expired or revoked. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: unauthorized: summary: unauthorized value: ok: false error: code: unauthorized message: Authentication required '403': description: >- `forbidden`: A daemon token was used; this route needs a user token. `forbidden`: You are not a member of a requested realm, or your token is restricted to other realms. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: forbidden: summary: forbidden value: ok: false error: code: forbidden message: You do not have access to do this forbidden (endpoint): summary: forbidden (endpoint) value: ok: false error: This token cannot mint tokens for those realms code: forbidden '422': description: >- `invalid_params`: `type` is missing, `realm_ids` is missing for `realm`, or `realm_id` is missing for `a2a` / `daemon_wire`. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: invalid_params: summary: invalid_params value: ok: false error: >- realm_ids: realm_ids (or permissions.domains.realms) is required when type is realm code: invalid_params '500': description: >- `internal_error`: An unexpected server fault. Retry later; if it persists, report it with the time of the request. content: application/json: schema: $ref: '#/components/schemas/HubErr' examples: internal_error: summary: internal_error value: ok: false error: Internal server error code: internal_error security: - BearerAuth: [] components: schemas: HubErr: type: object required: - ok - error description: >- Every failure. Route-policy denials (401/403/404, and 400 when neither realm_id nor org_id was sent) answer `error` as `{ code, message }`; errors raised by the endpoint answer `error` as the message with the code beside it in `code`. Every error has a code. See [Errors](/hub-api/errors). properties: ok: type: boolean description: Always false on error error: description: The message, or `{ code, message }` for an access denial. oneOf: - type: string - type: object required: - code - message properties: code: type: string message: type: string code: type: string description: Stable error code of an endpoint error. details: type: object additionalProperties: true description: Structured detail, when there is some. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: cliq_tok_* | cliq_dt_* description: >- User PAT (`cliq_tok_…`, including session-scoped) or realm token (`cliq_dt_…`). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.