opschain tokens create

Included from Basic tier

opschain tokens create --description <text> --expiry <duration|RFC3339>

Mints a native API key (ocak_…) for you — the identity your stored login session resolves — via the v2 AuthService.CreateAPIKey procedure. An API key is the standing credential for automation and for the admin bearer (store it with opschain admin login): authority identical to its owner's, explicit expiry, revocable at any time.

The key value is shown exactly once, here: the value alone on stdout (ready to capture), with the key's id, description and expiry on stderr. The server stores only a hash — opschain tokens list names keys by id and description and can never recover the value — and the CLI never stores it either (your stored login credential is untouched).

A stored login is required: without one the command fails with you are not logged in to <server> — run 'opschain login' first (exit 2). A server target is required the usual way (--server <url>, OPSCHAIN_SERVER or the active context); local mode has no tokens.

Flags

Flag	Meaning
--description <text>	What the key is for (required; at most 1000 characters — listings name the key by it).
--expiry <duration|RFC3339>	When the key expires (required): a Go duration from now (e.g. 720h) or an RFC3339 timestamp (e.g. 2027-01-01T00:00:00Z). Must be in the future and at most one year away.

Output

TOKEN=$(opschain tokens create --description runner-admin --expiry 720h)

api key 0199c7… (runner-admin) expires 2026-11-20T04:12:44Z
Store it now — the value is shown exactly once and cannot be retrieved again.

-o json|yaml prints id, description, expires_at and token as one machine document instead.

Exit codes

Code	Meaning
0	Key minted and shown.
1	The server refused or the request failed.
2	Usage error (no server target, not logged in, missing/unparseable flags).

Named errors

• you are not logged in to <server> — run 'opschain login' first — no stored credential for the target (exit 2).
• the server answered permission_denied: break-glass accounts cannot mint api keys under this security posture: … — a contained break-glass session may not mint a standing credential.
• the server answered permission_denied: your password must be rotated before this server accepts other requests: … — rotate with opschain passwd, then retry.
• the server answered invalid_argument: … — the server's validation (description present and ≤ 1000 characters; expiry present, in the future, ≤ 1 year away), named per field.

Examples

opschain tokens create --description "admin automation" --expiry 8760h
opschain tokens create --description ci --expiry 2027-01-01T00:00:00Z -o json

See also

• opschain docs cli/tokens-list — the inventory the minted key appears in.
• opschain docs cli/tokens-revoke — retiring a key by id.
• opschain docs cli/admin-login — storing the key as the admin bearer.
• opschain docs identity — the session lane and native api keys.