> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mesa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# tokens.create()

> Sign a short-lived access token locally.

`mesa.tokens.create(...)` signs an access token locally, in your own process. The private key never leaves that process, and no token resource is created on the server. Use it when you need to hand a credential to another environment (ex. a sandbox where the Mesa CLI will run).

```ts theme={null}
const result = await mesa.tokens.create({
  authors: [{ name: 'Mesa Bot', email: 'mesa-bot@example.com' }],
  scopes: ['read', 'write'],
  repos: ['acme/app'],
  ttl_seconds: 60 * 60, // 1 hour
});
```

<ParamField path="authors" type="[{ name: string; email?: string }, ...]">
  The authors recorded on commits made with this token, in order (ex. the user a session belongs to plus the agent doing the edits). Requires at least one entry and accepts at most 100.
</ParamField>

<ParamField path="scopes" type="string[] | undefined">
  Requested `read`, `write`, or `admin` scopes. Defaults to `read` and `write`.
</ParamField>

<ParamField path="repos" type="string[] | undefined">
  Restricts the token to these repositories, given as full `org/repo` names. Mutually exclusive with `repo_ids`.
</ParamField>

<ParamField path="repo_ids" type="string[] | undefined">
  Restricts the token to these repositories, given as canonical repository IDs (at most 250). Mutually exclusive with `repos`.
</ParamField>

<ParamField path="ttl_seconds" type="number | undefined">
  How long the token stays valid, in seconds. Defaults to `900` (15 minutes) and allows up to `14400` (4 hours).
</ParamField>

The result carries the token, its exact expiration, the effective scopes, and the repository restriction. Minting stays in the trusted process: a client built from an access token cannot call this method.