opschain admin agent-token create
packs:agents
opschain admin agent-token create --project <code> [--server <url>] [--group <name>] [--code <code>] [--ttl <d>] [--max-uses <n>] [--auth-token <token>]
Mints an agent registration token: a bearer credential an agent redeems on
its first run to enrol with the server. The token is scoped at mint time —
kind agent, the project the minted agents belong to, the fleet group they
join, and optionally a fixed agent code — so possession of the token
cannot enrol outside that scope. It is the agent-plane sibling of
runner-token create.
The command dials the server's agent-admin RPC, resolving the server and
credential the way every admin verb (and admin login's help) documents
them: --server, then OPSCHAIN_SERVER / the active context;
--auth-token, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by
opschain admin login.
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--project <code> | Project code the minted agents belong to. Required. |
--group <name> | Fleet group the minted agents join. Default default. |
--code <code> | Fix the agent code the token enrols. Empty: the agent chooses its own code (a code fixed here wins over the agent's). |
--ttl <d> | Token time-to-live (e.g. 30m, 24h). Default 1h. |
--max-uses <n> | Maximum redemptions. 0 (the default) = unlimited within the TTL; 1 = single-use. |
--auth-token <token> | Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login. |
Output
The token value prints to stdout (alone, pipe-friendly); the expiry prints to stderr:
<token>
expires at 2026-10-14T04:12:09Z
With -o json or -o yaml, a single document with token and
expires_at prints to stdout instead.
The server never returns a minted token's value again — list rows are named by fingerprint — so capture it now.
Exit codes
| Code | Meaning |
|---|---|
| 0 | The token was minted and printed. |
| 1 | The server refused or failed the request (including a rejected admin token). |
| 2 | Usage — required flags not set, or no admin token resolvable. |
Named errors
required flag(s) "project" not set— exit 2.a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>'— exit 2.this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login'— exit 2.the server rejected the credential — run 'opschain login' again, or check the admin token— exit 1.
Example
opschain admin agent-token create --server https://opschain.example.com \
--project demo --group default --ttl 24h --max-uses 1
See also
opschain docs cli/admin-agent-token-list— the token inventory with uses, expiry and status.opschain docs cli/admin-agents-list— the agents that enrolled.