> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baseten.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a volume access token

> Exchanges your API key for a short-lived token that authenticates against Baseten volume storage. A volume token is needed only to push and pull volume data; other volume operations use your API key directly. Tokens expire after one hour and cannot be renewed; exchange again for a fresh token. Push and tag capabilities require organization-level model management permission. Pass correlation_id to link the issued token to a client operation in server logs.



## OpenAPI

````yaml post /v1/volumes/token
openapi: 3.1.0
info:
  description: REST API for management of Baseten resources
  title: Baseten management API
  version: 1.0.0
servers:
  - url: https://api.baseten.co
security:
  - BearerAuth: []
paths:
  /v1/volumes/token:
    post:
      summary: Creates a volume access token
      description: >-
        Exchanges your API key for a short-lived token that authenticates
        against Baseten volume storage. A volume token is needed only to push
        and pull volume data; other volume operations use your API key directly.
        Tokens expire after one hour and cannot be renewed; exchange again for a
        fresh token. Push and tag capabilities require organization-level model
        management permission. Pass correlation_id to link the issued token to a
        client operation in server logs.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateVolumeTokenRequestV1'
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateVolumeTokenResponseV1'
      x-codeSamples:
        - lang: bash
          source: |-
            curl --request POST \
            --url https://api.baseten.co/v1/volumes/token \
            --header "Authorization: Bearer $BASETEN_API_KEY" \
            --data '{
              "scopes": null,
              "namespaces": null,
              "volumes": null,
              "correlation_id": null
            }'
        - lang: python
          source: |-
            import requests
            import os
            API_KEY = os.environ.get("BASETEN_API_KEY", "<YOUR_API_KEY>")
            url = "https://api.baseten.co/v1/volumes/token"

            headers = {"Authorization": f"Bearer {API_KEY}"}

            response = requests.request(
                "POST",
                url,
                headers=headers,
                json={'scopes': None, 'namespaces': None, 'volumes': None, 'correlation_id': None}
            )

            print(response.text)
components:
  schemas:
    CreateVolumeTokenRequestV1:
      additionalProperties: false
      properties:
        scopes:
          description: >-
            Capabilities the token grants, at least one. Requesting PUSH or TAG
            requires organization-level model management permission.
          items:
            $ref: '#/components/schemas/VolumeTokenScopeV1'
          minItems: 1
          title: Scopes
          type: array
        namespaces:
          description: >-
            Volume namespaces the token is limited to, lowercase ASCII, at least
            one. Pass only the namespaces the operation needs.
          items:
            type: string
          minItems: 1
          title: Namespaces
          type: array
        volumes:
          description: >-
            Volume names the token is limited to, lowercase ASCII, exact names
            only, at least one. The limit applies to every requested scope in
            every requested namespace.
          items:
            type: string
          minItems: 1
          title: Volumes
          type: array
        correlation_id:
          anyOf:
            - maxLength: 128
              pattern: ^[\x21-\x7e]+$
              type: string
            - type: 'null'
          default: null
          description: >-
            Optional client-chosen identifier, at most 128 printable ASCII
            characters. Echoed into server logs to link the issued token to a
            client operation.
          title: Correlation Id
      required:
        - scopes
        - namespaces
        - volumes
      title: CreateVolumeTokenRequestV1
      type: object
    CreateVolumeTokenResponseV1:
      properties:
        token:
          description: Volume access token. Pass as a bearer token to the volume APIs.
          title: Token
          type: string
        expires_at:
          description: >-
            Token expiry in ISO 8601 format. Tokens cannot be renewed; exchange
            again for a fresh token.
          format: date-time
          title: Expires At
          type: string
        scopes:
          description: Effective capabilities granted.
          items:
            $ref: '#/components/schemas/VolumeTokenScopeV1'
          title: Scopes
          type: array
        namespaces:
          description: Effective namespaces granted, in canonical lowercase form.
          items:
            type: string
          title: Namespaces
          type: array
        volumes:
          description: Effective volume names granted, in canonical lowercase form.
          items:
            type: string
          title: Volumes
          type: array
        bdn_endpoint:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Base URL of the volume API this token authenticates against. Null
            when the environment does not expose a public volume API yet.
          title: Bdn Endpoint
      required:
        - token
        - expires_at
        - scopes
        - namespaces
        - volumes
        - bdn_endpoint
      title: CreateVolumeTokenResponseV1
      type: object
    VolumeTokenScopeV1:
      description: |-
        Capability a volume token grants.

        - ``PULL``: read volume data.
        - ``INSPECT``: read volume metadata without data access.
        - ``PUSH``: upload and commit volume versions.
        - ``TAG``: move or remove tags.
      enum:
        - PULL
        - INSPECT
        - PUSH
        - TAG
      title: VolumeTokenScopeV1
      type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: >-
        Send `Authorization: Bearer <api_key>`. The legacy `Authorization:
        Api-Key <api_key>` scheme is also accepted.

````