create_token
ActiveTool of run.domani/domani
Create a new API token with optional scoped permissions and spend caps. The full key is returned only once - save it immediately. A token can only grant scopes it already has (scope attenuation) and spend caps at or below its own. Scopes: domains:read (GET /api/domains, GET /api/domains/{domain}, GET /api/domains/{domain}/dns, /dnssec, /status, /email/check, /auth-code, /transfer-away, /transfer-status, /analytics), domains:write (PUT /api/domains/{domain}/dns, POST/DELETE /api/domains/{domain}/dnssec, POST /connect, POST /verify, PUT /settings, PUT /parking, PUT/DELETE /api/domains/{domain}/for-sale, POST /api/domains/import, POST /import/verify), domains:transfer (POST /api/domains/buy, POST /transfer, POST /renew (involves payment, includes marketplace purchases)), tokens:read (GET /api/tokens), tokens:write (POST /api/tokens, DELETE /api/tokens/{id}), webhooks:read (GET /api/webhooks, GET /api/webhooks/{id}/deliveries), webhooks:write (POST /api/webhooks, PATCH /api/webhooks/{id}, DELETE /api/webhooks/{id}), email:read (GET /api/emails, /api/emails/{address}, /api/emails/{address}/messages, /api/emails/{address}/aliases, /api/domains/{domain}/email/status, /api/domains/{domain}/email/deliverability, /api/suppressions), email:write (POST /api/emails, POST /api/emails/{address}/send, POST /api/domains/{domain}/email/setup, aliases + catch-all, POST/DELETE /api/suppressions), email:delete (Permanently delete messages already in Trash. Moving messages to Trash only requires email:write. Grant this scope only to agents allowed to irreversibly erase email content), email:auth_secrets (Read messages classified as authentication mail (OTP / verification codes, password resets, magic links). Without it, email:read still lists them but subject and body come back redacted - so a stolen agent token can't harvest 2FA codes. Grant it only to agents that genuinely need to complete logins), account:read (GET /api/me, GET /api/agents/identity), account:write (DELETE /api/me, POST /api/billing/setup, POST /api/billing/subscribe, POST /api/billing/cancel, POST /api/me/resend-verification, POST/PATCH/DELETE /api/agents/identity), billing:read (GET /api/billing/invoices), search (GET /api/domains/search, /suggest, /whois, /dns-check, GET /api/tlds), deals:read (GET /api/deals, GET /api/deals/{id}), deals:write (POST /api/domains/sell, PATCH /api/deals/{id}), notifications:read (GET /api/notifications, GET /api/notifications/count), backorders:read (GET /api/backorders, GET /api/backorders/{id}), backorders:write (POST /api/backorders, DELETE /api/backorders/{id}). Use ['*'] for full access (default). When minting a token for a sub-agent that can buy, ALWAYS set max_per_tx/max_per_month.
Parameters schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"name": {
"type": "string",
"description": "Human-readable label, e.g. 'CI/CD', 'Sub-Agent'. Defaults to 'CLI'"
},
"scopes": {
"type": "array",
"items": {
"type": "string"
},
"description": "Permission scopes for this token. Defaults to parent token's scopes. Use ['*'] for full access"
},
"expires_at": {
"type": "string",
"format": "date-time",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
"description": "Absolute expiration date (ISO 8601). Alternative to expires_in"
},
"expires_in": {
"type": "integer",
"maximum": 31536000,
"minimum": 3600,
"description": "Token lifetime in seconds (min 3600 = 1h, max 31536000 = 1y). Omit for no expiration"
},
"max_per_tx": {
"type": "number",
"description": "Per-transaction spend cap in USD - any single charge above it is rejected server-side (SPEND_CAP_EXCEEDED)",
"exclusiveMinimum": 0
},
"max_per_month": {
"type": "number",
"description": "Rolling calendar-month spend cap in USD for all paid operations with this token",
"exclusiveMinimum": 0
},
"agent_identity_id": {
"type": "string",
"description": "Optional owned AgentIdentity id. Mail actions made with this token are attributed to that agent"
}
}
}No endpoints wrapped at confidence ≥ 0.50.
Parent server
run.domani/domani
https://github.com/gwendall/domani
1/7 registries