--- title: "overlane token create" description: "Mint a narrower child token for an agent's own work; the secret is shown once" --- > Documentation Index > Fetch the complete documentation index at: https://docs.overlane.app/llms.txt > Use this file to discover all available pages before exploring further. # overlane token create {/* Generated by apps/docs/scripts/generate.mjs (CLI pages from the command registry in packages/cli). Do not edit; run `pnpm --filter @overlane/docs gen`. */} Creates an agent token for one project (--project) or the whole team (--team-wide), with an optional list of allowed tools and a lifetime of 60 seconds to 90 days (default 7 days). Only an agent can mint, and only a token that is narrower than its own: a project token cannot mint a team-wide one. A token wider than the caller's caps waits for an independent approval; retry with OVERLANE_APPROVAL set. The secret is shown once. Revoke it with `overlane token revoke`. ## Usage ```sh overlane token create --label TEXT [--project PROJECT_ID] [--team-wide] [--tool NAME...] [--ttl-seconds SECONDS] [--service URL] [--team TENANT_ID] [--dry-run] ``` ## Flags | Flag | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `--label` | string | yes | | What the token is for, such as nightly-review | | `--project` | string | no | | Limit the token to one project | | `--team-wide` | boolean | no | | A token for every project of the team (instead of --project) | | `--tool` | string (repeatable) | no | | An MCP tool the token may call; repeat for more (default: every tool the role allows) | | `--ttl-seconds` | string | no | | Lifetime: 60 to 7776000 (default 604800) | | `--service` | string | no | | The service address (default: OVERLANE_SERVICE_URL, then the project's binding, then the hosted service) | | `--team` | string | no | | The team (tenant) to act on (default: the one your token belongs to) | | `--dry-run` | boolean | no | | Print the requests and file changes this command would make, then stop. Needs no credentials. | ## Examples ```sh overlane token create --label nightly-review --project prj_1 overlane token create --label child --project prj_1 --tool find_symbol --ttl-seconds 3600 --dry-run ``` ## Behavior - Effect: `write` (changes local or hosted state). - Needs credentials: yes. Uses the network: yes. - Supports `--dry-run`: yes. Accepts `--force`: no. - Machine-readable description: `overlane schema token create`. ## Result With `--json` (the default when stdout is not a terminal) the command prints this JSON Schema's shape on stdout. ```json { "anyOf": [ { "type": "object", "properties": { "token": { "type": "object", "properties": { "tokenId": { "type": "string", "minLength": 1, "maxLength": 64 }, "tenantId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$", "description": "tenant identifier" }, "label": { "type": "string", "minLength": 1, "maxLength": 100 }, "scope": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "team" } }, "required": [ "kind" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "project" }, "projectId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$", "description": "project identifier" } }, "required": [ "kind", "projectId" ], "additionalProperties": false } ] }, "tools": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 100 } }, "createdBy": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$", "description": "user identifier" }, "createdAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$" }, "expiresAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$" }, "revokedAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$" } }, "required": [ "tokenId", "tenantId", "label", "scope", "tools", "createdBy", "createdAt", "expiresAt" ], "additionalProperties": false }, "secret": { "type": "string", "minLength": 20 } }, "required": [ "token", "secret" ], "additionalProperties": false }, { "type": "object", "properties": { "dryRun": { "type": "boolean", "const": true }, "service": { "type": "string" }, "requests": { "type": "array", "items": { "type": "object", "properties": { "method": { "type": "string" }, "path": { "type": "string" }, "body": {}, "note": { "type": "string" } }, "required": [ "method", "path" ], "additionalProperties": false } }, "commands": { "type": "array", "items": { "type": "string" } }, "writes": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string" }, "action": { "type": "string", "enum": [ "write", "append", "delete" ] }, "description": { "type": "string" } }, "required": [ "path", "action", "description" ], "additionalProperties": false } }, "notes": { "type": "array", "items": { "type": "string" } } }, "required": [ "dryRun", "requests", "commands", "writes", "notes" ], "additionalProperties": false } ] } ``` See [exit codes](/cli/#exit-codes) for the status the process returns. Source: https://docs.overlane.app/cli/token-create/index.mdx