Managing one project from CI, a script, or an agent
Source
POST /projects/{id}/access-tokens, which requires a platform token
Scope
A single project, at full or read_only
Prefix
pt-
Retrievable
No — the secret is returned once, at creation
POST /projects/7c9e6679-7425-40de-944b-e07fc1f90ae7/functionsAuthorization: Bearer pt-...
A project token is refused on account-scoped endpoints, on other projects, and on the token-management endpoints themselves, all with 403. A read_only token is refused on mutations, and on the reads that return a credential — service keys, anon keys, variable values, and database connection strings. See Project access tokens and Using the API.
Missing Authorization header, invalid token, expired token, revoked project access token, or token for wrong project
403 Forbidden
Valid token but no permission, project access token out of scope or on the wrong project, CORS blocked, anon key revoked, or account banned
An expired and a revoked project access token both return 401 {"error": "invalid token"}. The response does not distinguish them, so a leaked secret cannot be probed for whether it still exists; read the token's record to find out which it was.
