tokens.create() - Mesa Docs

mesa.tokens.create(...) signs an access token locally, in your own process. The private key never leaves that process, and no token resource is created on the server. Use it when you need to hand a credential to another environment (ex. a sandbox where the Mesa CLI will run).

const result = await mesa.tokens.create({
  authors: [{ name: 'Mesa Bot', email: 'mesa-bot@example.com' }],
  scopes: ['read', 'write'],
  repos: ['acme/app'],
  ttl_seconds: 60 * 60, // 1 hour
});

[{ name: string; email?: string }, ...]

The authors recorded on commits made with this token, in order (ex. the user a session belongs to plus the agent doing the edits). Requires at least one entry and accepts at most 100.

string[] | undefined

Requested read, write, or admin scopes. Defaults to read and write.

string[] | undefined

Restricts the token to these repositories, given as full org/repo names. Mutually exclusive with repo_ids.

string[] | undefined

Restricts the token to these repositories, given as canonical repository IDs (at most 250). Mutually exclusive with repos.

number | undefined

How long the token stays valid, in seconds. Defaults to 900 (15 minutes) and allows up to 14400 (4 hours).

The result carries the token, its exact expiration, the effective scopes, and the repository restriction. Minting stays in the trusted process: a client built from an access token cannot call this method.