2. Create a Personal Access Token

Your JWT is short-lived and scoped to an interactive session — fine for logging in and minting a token, not for anything running unattended. A Personal Access Token (PAT) is what your scripts, notebooks, CI jobs, and integrations use going forward. Long-lived, scope-limited, and issued against the workspace active on your JWT session at creation time.

Create the token

curl -X POST {BASE_URL}/v1/api-tokens \
  -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "walkthrough-token",
    "scopes": [
      "chat:write",
      "models:read",
      "knowledgebases:read",
      "knowledgebases:write",
      "files:read",
      "files:write"
    ],
    "expires_in_days": 30
  }'

{
  "token": "cmnd_abc123.sk_xxxxxxxxxxxxxxxxxxxx",
  "id": "abc123",
  "name": "walkthrough-token",
  "scopes": ["chat:write", "models:read", "knowledgebases:read", "knowledgebases:write", "files:read", "files:write"],
  "created_at": "2026-09-02T12:34:56Z",
  "expires_at": "2026-10-02T12:34:56Z"
}

The token field is returned only once. Save it now — if you lose it, revoke the token and create a new one.

Export it. This is what you’ll send for every remaining step:

export PAT="cmnd_abc123.sk_xxxxxxxxxxxxxxxxxxxx"

Choosing scopes

The scopes above cover everything this walkthrough exercises. In your own integrations, request only what you actually need — smaller scope means smaller blast radius if a token leaks. See API Tokens for the full user scope reference.

A PAT is single-tenant — it stays scoped to the workspace active on the JWT session at creation. To create a token for a different workspace, switch workspaces on the JWT first (previous step), then create a new token.

Next: Discover models →

Getting Started

Guides

API Walkthrough

2. Create a Personal Access Token

Create the token

Choosing scopes

​Create the token

​Choosing scopes

Create the token

Choosing scopes