tokens.create() - Mesa Docs

mesa.tokens.create(...) signs an access token locally, in your own process. The private key never leaves that process, and no token resource is created on the server. Use it when you need to hand a credential to another environment (ex. a sandbox where the Mesa CLI will run).

result = await mesa.tokens.create(
    authors=[{"name": "Mesa Bot", "email": "mesa-bot@example.com"}],
    scopes=["read", "write"],
    repos=["acme/app"],
    ttl_seconds=60 * 60,  # 1 hour
)

list[SigningKeyAuthor] | None

The authors recorded on commits made with this token, in order (ex. the user a session belongs to plus the agent doing the edits). Requires at least one entry and accepts at most 100.

list[str] | None

Requested read, write, or admin scopes. Defaults to read and write.

list[str] | None

Restricts the token to these repositories, given as full org/repo names. Mutually exclusive with repo_ids.

list[str] | None

Restricts the token to these repositories, given as canonical repository IDs (at most 250). Mutually exclusive with repos.

int | None

How long the token stays valid, in seconds. Defaults to 900 (15 minutes) and allows up to 14400 (4 hours).

The returned TokenCreateResult carries the token, its exact expiration, the effective scopes, and the repository restriction. Minting stays in the trusted process: a client built from an access token cannot call this method.