> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deck.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a session token

> Creates a short-lived session token for the Auth Component.



## OpenAPI

````yaml /api-reference/v2.json post /token
openapi: 3.1.1
info:
  title: Deck API
  version: 2.0.0
servers:
  - url: https://api.deck.co/v2
    description: Production
security:
  - BearerAuth: []
tags:
  - name: Agents
  - name: Components
  - name: Credentials
  - name: Event Destinations
  - name: Events
  - name: Sessions
  - name: Sources
  - name: Storage
  - name: Task Runs
  - name: Tasks
  - name: Test
  - name: Triggers
paths:
  /token:
    post:
      tags:
        - Components
      summary: Create a session token
      description: Creates a short-lived session token for the Auth Component.
      operationId: createSessionToken
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSessionTokenResponse'
        '401':
          description: Unauthorized.
        '403':
          description: Forbidden.
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CreateSessionTokenResponse:
      required:
        - id
        - object
        - token
        - expires_at
        - created_at
        - request_id
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the session token, prefixed with `tok_`.
        object:
          type: string
          description: Always `token`.
        token:
          type: string
          description: >-
            The token value to pass to `<DeckAuthComponent />`. Prefixed with
            `tk_`. Treat as a bearer secret until it expires.
        expires_at:
          type: string
          format: date-time
          description: >-
            ISO 8601 timestamp at which the token stops being accepted. 30
            minutes after `created_at`.
        created_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp of when the token was created.
        request_id:
          type: string
          description: >-
            Unique identifier for the API request. Include this when contacting
            support.
      description: >-
        A session token for the Auth Component. Short-lived (30 minutes) and
        scoped to a single component session.
    ErrorResponse:
      required:
        - errors
        - request_id
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/TaskRunError'
          description: One or more errors that describe what went wrong.
        request_id:
          type: string
          description: Unique identifier for this request, useful for tracing.
      description: Standard error response.
    TaskRunError:
      required:
        - type
        - code
        - message
      type: object
      properties:
        type:
          type: string
          description: >-
            Error category (e.g. `source`, `auth`, `task`, `rate_limit`).
            Determines the class of failure.
        code:
          type: string
          description: Machine-readable error code. Use this for programmatic handling.
        message:
          type: string
          description: >-
            Human-readable explanation. Do not rely on this for logic — it may
            change.
        field:
          type:
            - 'null'
            - string
          description: The input field that caused the error, when applicable.
      description: Error details for a failed task run. Same structure as API-level errors.
  securitySchemes:
    BearerAuth:
      type: http
      description: Secret key (sk_live_...)
      scheme: bearer
      bearerFormat: JWT

````