> ## Documentation Index > Fetch the complete documentation index at: https://docs.platform.toloka.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Issue a project-scoped token > Send a permission preset or explicit permissions to create a token limited to this project and any listed `projectIds`. Send the returned token in the `X-Scoped-Token` header. Tokens last at most six hours and cannot issue other tokens. ## OpenAPI ````yaml /api-reference/openapi.json post /projects/{projectId}/tokens openapi: 3.1.0 info: description: >- Manage projects, datasets, labeling pipelines, and model training. **Beta:** endpoints, request and response shapes, and error contracts can change without notice or a backward-compatibility promise. title: Toloka Platform API version: 2.0.0 servers: - url: https://platform.toloka.ai/api/v2-beta security: - apiKeyAuth: [] - scopedTokenAuth: [] tags: - description: The authenticated API key owner. name: Account - description: A project is the container for pipelines, datasets, and files. name: Projects - description: Rows and typed fields. Field schemas are immutable once created. name: Datasets - description: Append rows to a dataset from a file. name: Dataset uploads - description: Read a dataset out as a file. name: Dataset exports - description: A pipeline is a graph of nodes that processes each dataset item. name: Pipelines - description: The nodes, connections, fields, and version of a pipeline graph. name: Pipeline graph - description: Execute a pipeline over a dataset and inspect each item. name: Runs - description: Per-node checks that a pipeline must pass before deployment. name: Checks - description: Named credentials available to pipeline code. name: Secrets - description: Project files available to pipeline code and labeling interfaces. name: Files - description: >- Global, read-only catalog of the models a synthetic generation node can use, with their budget bounds. name: Generation models - description: >- Global, read-only catalog of the expert audience: the values a node `audience` filter can use. name: Audience - description: >- Project lists of experts a node can take its workforce from with `audienceMode: service`. Available only to teams with the audience service enabled. name: Expert lists - description: >- Experts banned in a project: they cannot be invited and are removed from the work they are in. Available only to teams with expert bans enabled. name: Expert ban list - description: Global, read-only base model catalog. name: Base models - description: Project-owned mutable model-training drafts. name: Trainings - description: Project-owned Models and immutable Model Versions. name: Models - name: Batch inference paths: /projects/{projectId}/tokens: post: tags: - Projects summary: Issue a project-scoped token description: >- Send a permission preset or explicit permissions to create a token limited to this project and any listed `projectIds`. Send the returned token in the `X-Scoped-Token` header. Tokens last at most six hours and cannot issue other tokens. operationId: createProjectToken parameters: - in: path name: projectId required: true schema: $ref: '#/components/schemas/ProjectId' requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateScopedTokenBody' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ScopedToken' description: Token issued headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' '403': description: Your team does not allow one of the requested permissions headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' '404': description: Project not found headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' '429': description: >- Rate limit exceeded, or you already hold 1000 live tokens for one of the projects; revoke unused tokens first headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' x-codeSamples: - label: TypeScript SDK lang: typescript source: | import { createClient } from "@toloka-platform/sdk"; const client = createClient({ baseUrl: "https://platform.toloka.ai", apiKey: process.env.TOLOKA_API_KEY!, }); const token = await client.projects.createToken({ projectId: "pp.019a0000-0000-7000-8000-000000000001", preset: "read" }); console.log(token); components: schemas: ProjectId: description: Project ID with prefix `pp.`. pattern: >- ^pp\.[0-9a-f]{8}-[0-9a-f]{4}-[7][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ type: string CreateScopedTokenBody: anyOf: - properties: expiresInSeconds: description: Token lifetime in seconds, from 60 to 21600; defaults to 21600. maximum: 21600 minimum: 60 type: integer preset: description: >- A named permission set: `read` (Read everything), `write` (Read and write, no spending), `deploy` (Read, write and launch runs that spend money), `labeling-read` (Data labeling: read), `labeling-write` (Data labeling: read and write, no spending), `labeling-deploy` (Data labeling: read, write and launch pipelines). enum: - read - write - deploy - labeling-read - labeling-write - labeling-deploy type: string projectIds: description: >- Further projects the token may act in; the project in the path is always included. All projects must belong to the same team. items: $ref: '#/components/schemas/ProjectId' maxItems: 20 type: array required: - preset type: object - properties: expiresInSeconds: description: Token lifetime in seconds, from 60 to 21600; defaults to 21600. maximum: 21600 minimum: 60 type: integer permissions: description: Explicit `resource:operation` permissions. items: type: string minItems: 1 type: array projectIds: description: >- Further projects the token may act in; the project in the path is always included. All projects must belong to the same team. items: $ref: '#/components/schemas/ProjectId' maxItems: 20 type: array required: - permissions type: object ScopedToken: properties: expiresAt: description: When the token stops working. format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$ type: string id: description: >- Public handle of the token; use it to revoke without holding the secret. pattern: >- ^pst\.[0-9a-f]{8}-[0-9a-f]{4}-[7][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ type: string token: description: >- The access token. Returned only when created; save it before closing the response. type: string required: - id - token - expiresAt type: object headers: RateLimit-Limit: description: The maximum number of requests allowed in the current window. schema: type: integer RateLimit-Policy: description: The rate limit policy (e.g., "60;w=60"). schema: type: string RateLimit-Remaining: description: The number of requests remaining in the current window. schema: type: integer RateLimit-Reset: description: The number of seconds until the current window resets. schema: type: integer X-Request-Id: description: >- The request id: the X-Request-Id you sent when it is 1-128 characters of letters, digits, ".", "_" or "-", otherwise a generated UUID. Present on every response, including errors; quote it when reporting a problem. schema: type: string securitySchemes: apiKeyAuth: description: >- Enter `ApiKey ` in Authorization, including the `ApiKey ` prefix. In cURL and Python samples, `` means this full value. The TypeScript SDK adds the prefix for you. in: header name: Authorization type: apiKey scopedTokenAuth: description: >- Enter the project-scoped token as `pst_...` in X-Scoped-Token, without an `ApiKey ` prefix. Create a token with POST /projects/{projectId}/tokens. in: header name: X-Scoped-Token type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.