---
type: api
title: Create a service account token
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/v8/operation/operation-security-create-service-token
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/v8/operation/operation-security-create-service-token
products:
  - Elasticsearch
---

# Create a service account token


## Paths

- `POST` (also `PUT`) `/_security/service/{namespace}/{service}/credential/token/{name}`
- `POST` `/_security/service/{namespace}/{service}/credential/token`

#### Path parameters

- `namespace` (string) — required
  The name of the namespace, which is a top-level grouping of service accounts.
- `service` (string) — required
  The name of the service.
- `name` (string) — optional, leave it out to use `/_security/service/{namespace}/{service}/credential/token`
  The name for the service account token.
If omitted, a random name will be generated.

Token names must be at least one and no more than 256 characters.
They can contain alphanumeric characters (a-z, A-Z, 0-9), dashes (`-`), and underscores (`_`), but cannot begin with an underscore.

NOTE: Token names must be unique in the context of the associated service account.
They must also be globally unique with their fully qualified names, which are comprised of the service account principal and token name, such as `<namespace>/<service>/<token-name>`.

## Description

Create a service accounts token for access without requiring basic authentication.

NOTE: Service account tokens never expire.
You must actively delete them if they are no longer needed.

[Read the reference documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.19/service-accounts.html)

## Required authorization

- Cluster privileges: `manage_service_account`

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs support key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  To get API keys, use the `/_security/api_key` APIs.
- Basic: `Authorization: Basic <credentials>`
- Bearer: `Authorization: Bearer <token>`
  Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
  For examples, refer to [Token-based authentication services](https://www.elastic.co/guide/en/elasticsearch/reference/current/token-authentication-services.html)

## Query string parameters

- `refresh` (enum) — optional
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Response

`application/json`

- `created` (boolean)
- `token` (object)
  - `name` (string)
  - `value` (string)
## Code examples

#### Console

```console
POST /_security/service/elastic/fleet-server/credential/token/token1
```

#### JavaScript

```javascript
const response = await client.security.createServiceToken({
  namespace: "elastic",
  service: "fleet-server",
  name: "token1",
});
```

#### Python

```python
resp = client.security.create_service_token(
    namespace="elastic",
    service="fleet-server",
    name="token1",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential/token/token1" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.security().createServiceToken(c -> c
    .name("token1")
    .namespace("elastic")
    .service("fleet-server")
);
```

#### C#

```c#
var response = await client.Security
    .CreateServiceTokenAsync(new CreateServiceTokenRequest()
    {
        Name = "token1",
        Namespace = "elastic",
        Service = "fleet-server"
    });
```

#### PHP

```php
$resp = $client->security()->createServiceToken([
    "namespace" => "elastic",
    "service" => "fleet-server",
    "name" => "token1",
]);
```

#### Ruby

```ruby
response = client.security.create_service_token(
  namespace: "elastic",
  service: "fleet-server",
  name: "token1"
)
```

## Response examples

#### Create service token request example1

A successful response from `POST /_security/service/elastic/fleet-server/credential/token/token1`. The response includes the service account token, its name, and its secret value as a bearer token.

```json
{
  "created": true,
  "token": {
    "name": "token1",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ" 
  }
}
```