> ## Documentation Index > Fetch the complete documentation index at: https://docs.getcliq.io/llms.txt > Use this file to discover all available pages before exploring further. # Mint a CliqHub token > Creates a CliqHub token as the signed-in user: a user token (`cliq_tok_…`, the default) for scripts and CI, or a realm token (`type: realm`, `cliq_dt_…`) to enroll another daemon in `realm_id`. The token is shown only in this reply. From the CLI: `cliq auth token ci-runner`. No credential is needed from this machine. From another host, send `Authorization: Bearer` with a dispatch token CliqHub signed for this daemon or a `cliq_tok_…` personal token of a user in the daemon's realm; this only works once the daemon is connected to CliqHub. See [Authentication](/daemon-api/overview#authentication). ## OpenAPI ````yaml /openapi/daemon-by-tag/daemon-auth.yaml post /v1/auth/token openapi: 3.1.0 info: title: cliqd API version: 1.9.48 description: >- HTTP API of `cliqd`, the local Cliq daemon. Generated from the daemon source by `scripts/generate_daemon_openapi.mjs` — do not edit by hand. See the [overview](/daemon-api/overview). servers: - url: http://127.0.0.1:4900 description: Local daemon (default port; `CLIQ_DAEMON_PORT` changes it) security: [] tags: - name: Daemon Sign-in description: >- Signing this daemon in to CliqHub, choosing the realm it belongs to, and minting CliqHub tokens with its sign-in. `cliq login` and `cliq logout` use these endpoints. A daemon that has never joined a realm **enrolls** in one the first time it signs in. Once enrolled it stays in that realm: signing in again keeps it, and moving it to another realm needs cliqd started with `--allow-realm-override` plus an explicit confirmation. Sign-in and sign-out are only accepted from the machine running cliqd. paths: /v1/auth/token: post: tags: - Daemon Sign-in summary: Mint a CliqHub token description: >- Creates a CliqHub token as the signed-in user: a user token (`cliq_tok_…`, the default) for scripts and CI, or a realm token (`type: realm`, `cliq_dt_…`) to enroll another daemon in `realm_id`. The token is shown only in this reply. From the CLI: `cliq auth token ci-runner`. No credential is needed from this machine. From another host, send `Authorization: Bearer` with a dispatch token CliqHub signed for this daemon or a `cliq_tok_…` personal token of a user in the daemon's realm; this only works once the daemon is connected to CliqHub. See [Authentication](/daemon-api/overview#authentication). operationId: daemon_post_auth_token requestBody: required: true content: application/json: schema: type: object properties: label: type: string minLength: 1 description: Token label type: description: '`user` (default) or `realm` (daemon enrollment)' type: string enum: - user - realm realm_id: description: Realm the token is scoped to (type `realm`) type: string minLength: 1 required: - label examples: user: summary: A user token for CI value: label: ci-runner realm: summary: A realm token for another daemon value: label: build-server type: realm realm_id: 5b0c3a7e-2f4d-4b8e-9a51-7c1d2e3f4a5b responses: '200': description: Success. content: application/json: schema: type: object required: - ok - data properties: ok: type: boolean const: true data: $ref: '#/components/schemas/HubTokenResult' example: ok: true data: token: cliq_tok_4f9a… name: ci-runner id: 42 type: user '400': description: >- `BAD_REQUEST` — `type` is `realm` but no `realm_id` was sent, or the body is not valid JSON. `PAYLOAD_INVALID` — The body (query string for `GET`) fails the request schema. `details` lists each issue. content: application/json: schema: $ref: '#/components/schemas/ErrorReply' examples: BAD_REQUEST: summary: BAD_REQUEST value: ok: false error: code: BAD_REQUEST message: '--realm is required for realm tokens' PAYLOAD_INVALID: summary: PAYLOAD_INVALID value: ok: false error: code: PAYLOAD_INVALID message: >- label: Invalid input: expected string, received undefined details: - path: label message: 'Invalid input: expected string, received undefined' '401': description: '`UNAUTHORIZED` — The daemon is not signed in to CliqHub.' content: application/json: schema: $ref: '#/components/schemas/ErrorReply' examples: UNAUTHORIZED: summary: UNAUTHORIZED value: ok: false error: code: UNAUTHORIZED message: 'Not logged in. Run: cliq login' '403': description: >- `WEB_REQUEST_REFUSED` — The request carries an `Origin` header (it came from a web page). `HOST_NOT_LOCAL` — A loopback caller addressed a `Host` other than localhost (DNS rebinding guard). `LOCAL_ONLY` — The daemon isn't connected to CliqHub (no dispatch key) and the caller is on another host. `FORBIDDEN` — A `cliq_tok_…` token's user is not in this daemon's realm ACL, or the ACL is not loaded yet. content: application/json: schema: $ref: '#/components/schemas/ErrorReply' examples: WEB_REQUEST_REFUSED: summary: WEB_REQUEST_REFUSED value: ok: false error: code: WEB_REQUEST_REFUSED message: cliqd doesn't accept requests from web pages HOST_NOT_LOCAL: summary: HOST_NOT_LOCAL value: ok: false error: code: HOST_NOT_LOCAL message: cliqd only answers requests addressed to localhost LOCAL_ONLY: summary: LOCAL_ONLY value: ok: false error: code: LOCAL_ONLY message: >- This cliqd isn't connected to CliqHub yet, so from another machine it only accepts a local token (minted by tokens/create on the machine running cliqd) FORBIDDEN: summary: FORBIDDEN value: ok: false error: code: FORBIDDEN message: Access denied — identity not in realm ACL '500': description: >- `INTERNAL_ERROR` — CliqHub refused (the message is CliqHub's, for example no access to the realm) or could not be reached. content: application/json: schema: $ref: '#/components/schemas/ErrorReply' examples: INTERNAL_ERROR: summary: INTERNAL_ERROR value: ok: false error: code: INTERNAL_ERROR message: Failed to create token security: - {} - DaemonBearer: [] components: schemas: HubTokenResult: type: object required: - token - name - type properties: token: type: string description: >- The new token (`cliq_tok_…` user token or `cliq_dt_…` realm token). Shown only here. example: cliq_tok_4f9a… name: type: string example: ci-runner id: type: - string - integer description: CliqHub's id for the token. example: 42 type: type: string enum: - user - realm example: user realm_ids: type: array items: type: string description: For a realm token, the realm it is for. ErrorReply: type: object description: >- Every failure. Switch on `error.code` — it is stable; `message` is for people and may change. required: - ok - error properties: ok: type: boolean const: false error: type: object required: - code - message properties: code: type: string description: Stable error code. See [Errors](/daemon-api/errors). example: TEAM_NOT_FOUND message: type: string description: What went wrong and, where possible, what to do. example: Team 'acme/code-review' not found details: description: >- Structured detail when there is some: the list of schema issues for `PAYLOAD_INVALID`, the agent problems for `TEAM_AGENT_CONFIG_REQUIRED`, … securitySchemes: DaemonBearer: type: http scheme: bearer description: >- Not needed from the same machine. From another host: a dispatch JWT CliqHub signed for this daemon, or a `cliq_tok_…` personal token whose user is in the daemon's realm. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.