> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a new admin access token

> This endpoint enables you to create a new admin access token for the application provided in the header.

POST/credentials/apikeys/applications/self/accesstokens

This endpoint enables you to create a new admin access token for the application provided in the header. You can create a maximum of 20 admin access tokens per application.

You must assign roles when creating a new admin access token. You can also assign an expiration date other than the 90-day default value using the `expires_at` field.

* Roles - You must assign one or more roles to your admin access tokens to control their permissions. You cannot create admin access tokens with roles that are not currently assigned to the admin access token you are using to call this endpoint.
* Expiration - When creating a new admin access token, you can set an expiration date using the `expires_at` parameter. The `expires_at` field is optional, and accepts a value between one and 365 days in the future. If you do not provide the `expires_at` field, the expiration of the new admin access token is set to 90 days in the future by default.

> [!WARNING]
>
> **Important**\
> Admin access token values are secret and are only returned once, at the time of creation. These secret values are found in the `secret_value` field of the admin access token. Record the secret value when you create a new admin access token and store it securely.

## Request body

| Fields | Description |
| - | - |
| roles array of strings  Required | List of roles assigned to an admin access token. **Allowable Values:**  `read`, `write`, `pci`, `program-manager` **Format:** `["read", "write"]` |
| expires\_at datetime  Optional | Date and time of admin access token expiration, using ISO-8601 format. **Allowable Values:** **Format:** yyyy-MM-ddThh:mm:ssZ |

## Response body

| Fields | Description |
| - | - |
| token\_id string  Conditionally returned | Unique identifier of the admin access token. **Allowable Values:**  255 char max |
| roles array of strings  Conditionally returned | List of roles assigned to the admin access token. **Allowable Values:**  `read`, `write`, `pci`, `program-manager` **Format:** `["read", "write"]` |
| expires\_at datetime  Conditionally returned | Date and time of admin access token expiration (if applicable), in UTC. **Allowable Values:** **Format:** yyyy-MM-ddThh:mm:ssZ |
| created\_at datetime  Conditionally returned | Date and time when the admin access token was created, in UTC. **Allowable Values:** **Format:** yyyy-MM-ddThh:mm:ssZ |
| secret\_value string  Conditionally returned | Actual admin access token secret value to be used for authentication. This secret value is only returned at time of admin access token creation. **Allowable Values:**  255 char max |


## Related topics

- [Self-Service Credentials Overview](https://www.marqeta.com/docs/core-api/self-service-credentials.md)
- [Create client access token](https://www.marqeta.com/docs/core-api/users/user-authentication/create-client-access-token.md)
- [List all admin access tokens](https://www.marqeta.com/docs/core-api/self-service-credentials/list-all-admin-access-tokens.md)
- [Delete current admin access token](https://www.marqeta.com/docs/core-api/self-service-credentials/delete-current-admin-access-token.md)
- [Retrieve details of the current admin access token](https://www.marqeta.com/docs/core-api/self-service-credentials/retrieve-details-current-admin-access-token.md)