# Create a management token for the CLI

`POST https://api.keenauth.com/v1/environments/{environment_id}/management-tokens` · called by `keenauth login`

Exchanges the CLI's sign-in for a 10 minute token of one environment. You do not call this endpoint yourself: `keenauth login` signs you in with your dashboard account (device authorization or, with `--web`, a loopback redirect with PKCE) and the CLI requests a token for each environment it works on. The token is bound to the CLI's key (DPoP) and carries only the permissions of your dashboard role in that environment.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Authorization` | yes | `DPoP <access token>`: the access token the CLI received when you signed in. |
| `DPoP` | yes | A DPoP proof for this request, signed with the key the access token is bound to; it carries the hash of the access token and the server nonce. |
| `Content-Type` | yes | `application/json`. |

Body: an empty JSON object, `{}`. Any other member is refused with `unknown_field`. The request has no `Idempotency-Key`: every call issues a new token.

## Response

`201 Created` with `Cache-Control: no-store`:

| Field | Description |
| --- | --- |
| `access_token` | The management token. Send it as `Authorization: DPoP <token>` with a proof of the same key. |
| `token_type` | Always `DPoP`. |
| `expires_in` | Lifetime in seconds: `600`. |
| `expires_at` | End of the lifetime (RFC 3339, UTC). |
| `environment_id` | The environment the token is for. |
| `audience` | The cell the token is for (`<region>/<cell>`). |
| `api_base` | Base URL of the regional API that accepts the token. |
| `permissions` | The environment permissions of your dashboard role. |

The CLI keeps the token in memory only. A role change takes effect within 10 minutes at most; when a role is removed, the open tokens of that user are revoked.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No access token was sent. |
| 401 | `invalid_token` | The access token is invalid, expired or not the CLI's; sign in again with `keenauth login`. |
| 401 | `invalid_dpop_proof` | The DPoP proof is missing, repeated or does not match the request or the token's key. |
| 401 | `use_dpop_nonce` | Retry with a proof that carries the nonce of the `DPoP-Nonce` response header. |
| 401 | `insufficient_user_authentication` | Multi-factor authentication (or, for your role, a passkey or security key) is required; sign in again. |
| 404 | `not_found` | The environment does not exist or you have no dashboard role in it. |
| 429 | `rate_limited` | More than 30 tokens per minute for your user (shared with the dashboard); wait for `Retry-After`. |

## Example

```bash
curl -X POST https://api.keenauth.com/v1/environments/env_01jb0000000000000000000000/management-tokens \
  -H "Authorization: DPoP $ACCESS_TOKEN" \
  -H "DPoP: $DPOP_PROOF" \
  -H "Content-Type: application/json" \
  -d '{}'
```