---
type: api
title: Create a service account token
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-create-service-token
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-create-service-token
products:
  - Elasticsearch
---

# Create a service account token


Availability:

## Paths

- `POST` (also `PUT`) `/_security/service/{namespace}/{service}/credential/token/{name}`
- `POST` `/_security/service/{namespace}/{service}/credential/token`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

#### Path Parameters

- `namespace` (string)
  The name of the namespace, which is a top-level grouping of service accounts.
- `service` (string)
  The name of the service.
- `name` (string Name) — optional, leave it out to use `/_security/service/{namespace}/{service}/credential/token`
  The name for the service account token.
If omitted, a random name will be generated.

Token names must be at least one and no more than 256 characters.
They can contain alphanumeric characters (a-z, A-Z, 0-9), dashes (`-`), and underscores (`_`), but cannot begin with an underscore.

NOTE: Token names must be unique in the context of the associated service account.
They must also be globally unique with their fully qualified names, which are comprised of the service account principal and token name, such as `<namespace>/<service>/<token-name>`.

## Description

Create a service accounts token for access without requiring basic authentication.

NOTE: Service account tokens never expire.
You must actively delete them if they are no longer needed.

IMPORTANT: On Serverless, non-operator users can create tokens for only `elastic/fleet-server` and `elastic/fleet-server-remote`.
Creating tokens for any other service account requires operator privileges.

## Required authorization

* Cluster privileges: `manage_service_account`

[More about service accounts](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/service-accounts)

## Query String Parameters

- `refresh` (enum Refresh)
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Response

`application/json`

- `created` (boolean)
- `token` ({} Token)
  - `name` (string Name)
  - `value` (string)
## Code Examples

#### Console

```console
POST /_security/service/elastic/fleet-server/credential/token/token1
```

#### JavaScript

```javascript
const response = await client.security.createServiceToken({
  namespace: "elastic",
  service: "fleet-server",
  name: "token1",
});
```

#### Python

```python
resp = client.security.create_service_token(
    namespace="elastic",
    service="fleet-server",
    name="token1",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential/token/token1" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().createServiceToken(c -> c
    .name("token1")
    .namespace("elastic")
    .service("fleet-server")
);
```

#### C#

```c#
var response = await client.Security
    .CreateServiceTokenAsync(new CreateServiceTokenRequest()
    {
        Name = "token1",
        Namespace = "elastic",
        Service = "fleet-server"
    });
```

#### PHP

```php
$resp = $client->security()->createServiceToken([
    "namespace" => "elastic",
    "service" => "fleet-server",
    "name" => "token1",
]);
```

#### Ruby

```ruby
response = client.security.create_service_token(
  namespace: "elastic",
  service: "fleet-server",
  name: "token1"
)
```

## Response Examples

#### Create service token request example1

A successful response from `POST /_security/service/elastic/fleet-server/credential/token/token1`. The response includes the service account token, its name, and its secret value as a bearer token.

```json
{
  "created": true,
  "token": {
    "name": "token1",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ" 
  }
}
```