--- title: Create Token --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Accounts](https://developers.cloudflare.com/api/python/resources/accounts) [Tokens](https://developers.cloudflare.com/api/python/resources/accounts/subresources/tokens) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Create Token accounts.tokens.create(TokenCreateParams\*\*kwargs) -> [TokenCreateResponse]() POST/accounts/{account\_id}/tokens Create a new Account Owned API token. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` ##### Accepted Permissions (at least one required) `Account API Tokens Write` ##### ParametersExpand Collapse account\_id: str Account identifier tag. maxLength32 minLength32 [Link to this property](<#(resource)%20accounts.tokens%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>) name: str Token name. maxLength120 [Link to this property](<#(resource)%20accounts.tokens%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20name%20%3E%20(schema)>)

policies: Iterable\[TokenPolicy] List of access policies assigned to the token.

id: str Policy identifier. Link to this property

effect: Literal\["allow", "deny"] Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: List\[PermissionGroup] A set of permission groups that are specified to the policy.

id: str Identifier of the permission group. Link to this property

meta: Optional\[PermissionGroupMeta] Attributes associated to the permission group.

category: Optional\[str] A category used to group permission groups. Link to this property deprecated: Optional\[str] Indicates whether the permission group is deprecated. Link to this property description: Optional\[str] Additional information about the permission group. Link to this property editable: Optional\[str] Indicates whether the permission group can be edited. Link to this property eol\_at: Optional\[datetime] The planned end-of-life date and time, when provided. formatdate-time Link to this property label: Optional\[str] A label identifying the permission group. Link to this property scopes: Optional\[str] The scope associated with the permission group. Link to this property visibility: Optional\[str] Indicates the permission group’s availability or visibility. Link to this property

Link to this property name: Optional\[str] Name of the permission group. Link to this property

Link to this property

resources: Union\[Dict\[str, str], Dict\[str, Dict\[str, str]]] A list of resource names that the policy applies to.

One of the following: Dict\[str, str] Map of simple string resource permissions Link to this property Dict\[str, Dict\[str, str]] Map of nested resource permissions Link to this property

Link to this property

[Link to this property](<#(resource)%20accounts.tokens%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20policies%20%3E%20(schema)>)

condition: Optional\[Condition]

request\_ip: Optional\[ConditionRequestIP] Client IP restrictions.

in\_: Optional\[Sequence\[TokenConditionCIDRList]] List of IPv4/IPv6 CIDR addresses. Link to this property not\_in: Optional\[Sequence\[TokenConditionCIDRList]] List of IPv4/IPv6 CIDR addresses. Link to this property

Link to this property

[Link to this property](<#(resource)%20accounts.tokens%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20condition%20%3E%20(schema)>) expires\_on: Optional\[Union\[str, datetime]] The expiration time on or after which the JWT MUST NOT be accepted for processing. formatdate-time [Link to this property](<#(resource)%20accounts.tokens%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20expires_on%20%3E%20(schema)>) not\_before: Optional\[Union\[str, datetime]] The time before which the token MUST NOT be accepted for processing. formatdate-time [Link to this property](<#(resource)%20accounts.tokens%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20not_before%20%3E%20(schema)>) ##### ReturnsExpand Collapse

class TokenCreateResponse: …

id: Optional\[str] Token identifier tag. maxLength32 Link to this property

condition: Optional\[Condition]

request\_ip: Optional\[ConditionRequestIP] Client IP restrictions.

in\_: Optional\[List\[TokenConditionCIDRList]] List of IPv4/IPv6 CIDR addresses. Link to this property not\_in: Optional\[List\[TokenConditionCIDRList]] List of IPv4/IPv6 CIDR addresses. Link to this property

Link to this property

Link to this property creator\_email\_at\_creation: Optional\[str] The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available. maxLength90 Link to this property expires\_on: Optional\[datetime] The expiration time on or after which the JWT MUST NOT be accepted for processing. formatdate-time Link to this property issued\_on: Optional\[datetime] The time on which the token was created. formatdate-time Link to this property last\_used\_on: Optional\[datetime] Last time the token was used. formatdate-time Link to this property modified\_on: Optional\[datetime] Last time the token was modified. formatdate-time Link to this property name: Optional\[str] Token name. maxLength120 Link to this property not\_before: Optional\[datetime] The time before which the token MUST NOT be accepted for processing. formatdate-time Link to this property

policies: Optional\[List\[TokenPolicy]] List of access policies assigned to the token.

id: str Policy identifier. Link to this property

effect: Literal\["allow", "deny"] Allow or deny operations against the resources.

One of the following: "allow" Link to this property "deny" Link to this property

Link to this property

permission\_groups: List\[PermissionGroup] A set of permission groups that are specified to the policy.

id: str Identifier of the permission group. Link to this property

meta: Optional\[PermissionGroupMeta] Attributes associated to the permission group.

Link to this property name: Optional\[str] Name of the permission group. Link to this property

Link to this property

resources: Union\[Dict\[str, str], Dict\[str, Dict\[str, str]]] A list of resource names that the policy applies to.

One of the following: Dict\[str, str] Map of simple string resource permissions Link to this property Dict\[str, Dict\[str, str]] Map of nested resource permissions Link to this property

Link to this property

Link to this property provisioner\_id: Optional\[str] The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisioner_type is present and null when the identifier is unavailable. Link to this property provisioner\_type: Optional\[str] The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens. Link to this property

status: Optional\[Literal\["active", "disabled", "expired"]] Status of the token.

One of the following: "active" Link to this property "disabled" Link to this property "expired" Link to this property

Link to this property value: Optional\[TokenValue] The token value. maxLength80 minLength40 Link to this property

[Link to this property](<#(resource)%20accounts.tokens%20%3E%20(model)%20token_create_response%20%3E%20(schema)>) ### Create Token Python HTTPTypeScriptPythonGoTerraform ``` import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) token = client.accounts.tokens.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", name="readonly token", policies=[{ "effect": "allow", "permission_groups": [{ "id": "c8fed203ed3043cba015a93ad1616f1f" }, { "id": "82e64a83756745bbbb1c9c2701bf816b" }], "resources": { "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*" }, }], ) print(token.id) ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "ed17574386854bf78a67040be0a770b0", "condition": { "request_ip": { "in": [ "123.123.123.0/24", "2606:4700::/32" ], "not_in": [ "123.123.123.100/24", "2606:4700:4700::/48" ] } }, "creator_email_at_creation": "user@example.com", "expires_on": "2020-01-01T00:00:00Z", "issued_on": "2018-07-01T05:20:00Z", "last_used_on": "2020-01-02T12:34:00Z", "modified_on": "2018-07-02T05:20:00Z", "name": "readonly token", "not_before": "2018-07-01T05:20:00Z", "policies": [ { "id": "f267e341f3dd4697bd3b9f71dd96247f", "effect": "allow", "permission_groups": [ { "id": "c8fed203ed3043cba015a93ad1616f1f", "meta": { "category": "category", "deprecated": "deprecated", "description": "description", "editable": "editable", "eol_at": "2019-12-27T18:11:19.117Z", "label": "load_balancer_admin", "scopes": "com.cloudflare.api.account", "visibility": "visibility" }, "name": "Zone Read" }, { "id": "82e64a83756745bbbb1c9c2701bf816b", "meta": { "category": "category", "deprecated": "deprecated", "description": "description", "editable": "editable", "eol_at": "2019-12-27T18:11:19.117Z", "label": "fbm_user", "scopes": "com.cloudflare.api.account", "visibility": "visibility" }, "name": "Magic Network Monitoring" } ], "resources": { "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*" } } ], "provisioner_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4", "provisioner_type": "com.cloudflare.api.oauthtoken", "status": "active", "value": "8M7wS6hCpXVc-DoRnPPY_UCWPgy8aea4Wy6kCe5T" } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "ed17574386854bf78a67040be0a770b0", "condition": { "request_ip": { "in": [ "123.123.123.0/24", "2606:4700::/32" ], "not_in": [ "123.123.123.100/24", "2606:4700:4700::/48" ] } }, "creator_email_at_creation": "user@example.com", "expires_on": "2020-01-01T00:00:00Z", "issued_on": "2018-07-01T05:20:00Z", "last_used_on": "2020-01-02T12:34:00Z", "modified_on": "2018-07-02T05:20:00Z", "name": "readonly token", "not_before": "2018-07-01T05:20:00Z", "policies": [ { "id": "f267e341f3dd4697bd3b9f71dd96247f", "effect": "allow", "permission_groups": [ { "id": "c8fed203ed3043cba015a93ad1616f1f", "meta": { "category": "category", "deprecated": "deprecated", "description": "description", "editable": "editable", "eol_at": "2019-12-27T18:11:19.117Z", "label": "load_balancer_admin", "scopes": "com.cloudflare.api.account", "visibility": "visibility" }, "name": "Zone Read" }, { "id": "82e64a83756745bbbb1c9c2701bf816b", "meta": { "category": "category", "deprecated": "deprecated", "description": "description", "editable": "editable", "eol_at": "2019-12-27T18:11:19.117Z", "label": "fbm_user", "scopes": "com.cloudflare.api.account", "visibility": "visibility" }, "name": "Magic Network Monitoring" } ], "resources": { "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*" } } ], "provisioner_id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4", "provisioner_type": "com.cloudflare.api.oauthtoken", "status": "active", "value": "8M7wS6hCpXVc-DoRnPPY_UCWPgy8aea4Wy6kCe5T" } } ```