Create a Private API Token
Creates a private token for server-to-server integrations. Private tokens are always stateless (no session required) and provide better performance for server-to-server use cases. The API will reject private token-authenticated requests that originate from web browsers.
**Required Scopes**
* `Manage` `Storefront API Tokens`
> NOTE: While neither `channel_id` nor `channel_ids` is labelled as required, one must be included in the request body. Including neither will throw an error, and including both will result in unexpected behaviors.
Authentication
X-Auth-Tokenstring
### OAuth scopes
| UI Name | Permission | Parameter |
|:--------|:-----------|:----------|
| Storefront API Customer Impersonation Tokens | manage | `store_storefront_api_customer_impersonation` |
| Storefront API Tokens | manage | `store_storefront_api` |
### Authentication header
| Header | Argument | Description |
|:-------|:---------|:------------|
| `X-Auth-Token` | `access_token` | For more about API accounts that generate `access_token`s, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts). |
### Further reading
For example requests and more information about authenticating BigCommerce APIs, see [Authentication and Example Requests](/developer/docs/overview/api-fundamentals/api-accounts).
For more about BigCommerce OAuth scopes, see our [Guide to API Accounts](/developer/docs/overview/api-fundamentals/api-accounts#oauth-scopes).
Request
This endpoint expects an object.
expires_at
Unix timestamp (UTC time) defining when the token should expire. Supports seconds, but does not support milliseconds, microseconds, or nanoseconds.
scopes
Access scope identifiers. Required for private tokens. Include all scopes required by the GraphQL fields you need.
Allowed values:
Response
data
meta
Response metadata.
