REST API›Enterprise›User

POST

Create access token

Create an access token to use BitGo APIs. BitGo restricts access tokens in the production environment to specific IP addresses. However, access tokens in the test environment don't require an IP address restriction. If you omit a spending limit, you must unlock the token using the Unlock session endpoint on a regular basis to permit operations such as withdrawals. Therefore, BitGo recommends including a spending limit.

Body Params

object

  • scope array of strings

    The permissions granted by this access token.

    • all - Access all actions in the test environment.
    • crypto_compare - Call CryptoCompare API.
    • enterprise_manage_all - Manage users and settings for any enterprise to which the user belongs.
    • enterprise_view_all - View any enterprise to which the user belongs.
    • metamask_institutional - [DEPRECATED] Enables using BitGo wallets in the MetaMask Institutional extension.
    • openid - Verify your BitGo user ID using OpenID Connect.
    • pending_approval_update - Approve or reject pending actions that require approval to proceed.
    • portfolio_view - [DEPRECATED] Call the Portfolio API.
    • profile - View your BitGo Profile.
    • settlement_network_read - View your client's Go Network data, enabling allocations to and from your platform. Only for Go Network partners.
    • settlement_network_write - Update your client's Go Network data, enabling allocations to and from your platform. Only for Go Network partners.
    • trade_trade - Initiate trades.
    • trade_view - View trades.
    • trade_fix - Access the Trade FIX API gateway.
    • wallet_approve - Approve policies and transactions for a wallet where the user is a wallet admin. Requires wallet context: use ["wallet_approve:walletId"].
    • wallet_approve_all - Approve transactions for any wallet where the user is a wallet admin within any enterprise to which the user belongs.
    • wallet_approve_enterprise - Approve transactions for any wallet where the user is a wallet admin within a single enterprise.
    • wallet_create - Create wallets.
    • wallet_edit - Edit comments on a transfer. Requires wallet context: use ["wallet_edit:walletId"].
    • wallet_edit_all - Edit comments on all transfers within multiple enterprises.
    • wallet_edit_enterprise - [DEPRECATED] Edit comments on all transfers within a single enterprise.
    • wallet_freeze - Freeze a wallet. Requires wallet context: use ["wallet_freeze:walletId"].
    • wallet_freeze_all - Freeze any wallet within any enterprises to which the user belongs.
    • wallet_manage - Manage settings for a wallet where the user is a wallet admin. Requires wallet context: use ["wallet_manage:walletId"] where walletId is the specific wallet ID. For managing multiple or all wallets, use wallet_manage_all or wallet_manage_enterprise.
    • wallet_manage_all - Manage settings for any wallet where the user is a wallet admin within any enterprise to which the user belongs.
    • wallet_manage_enterprise - Manage settings for any wallet where the user is a wallet admin within a single enterprise.
    • wallet_spend - Initiate transactions from a wallet. Requires wallet context: use ["wallet_spend:walletId"].
    • wallet_spend_all - Initiate transactions from any wallet within any enterprise to which the user belongs.
    • wallet_spend_enterprise - Initiate transactions from any wallet within a single enterprise.
    • wallet_stake - Initiate staking transactions from a wallet. Requires wallet context: use ["wallet_stake:walletId"].
    • wallet_stake_all - Initiate staking transactions from any wallet within any enterprise to which the user belongs.
    • wallet_view - View a wallet. Requires wallet context: use ["wallet_view:walletId"].
    • wallet_view_all - View any wallet within any enterprise to which the user belongs.
    • wallet_view_enterprise - View any wallet within a single enterprise.

    ONE OF

    array of string enums

  • duration number
    The duration of the access token in seconds.
  • label string required
    A label for the access token.
  • otp string required
    The one-time password.
  • admin boolean
    True, if this access token has admin permissions.
  • adminScope string enum
    Scope for admin permissions. Defaults to 'full' when omitted.
    readfull
  • ipRestrict array of strings nullable
    Restricts the access token to use only from the provided IP addresses. Required for access tokens in the production environment. Not required for access tokens in the test environment.
  • enterprise string
    The enterprise ID that the user belongs to.
  • spendingLimits array of objects
    spendingLimits object
    • coin string required
      A cryptocurrency symbol or token ticker symbol
    • maxLimit boolean
    • txValueLimit string or number
  • allErc20TokensLimit object
    allErc20TokensLimit object
    • enabled boolean
    • maxLimit boolean
    • txValueLimit string or number
  • accessTokenTemplateId string

    ID of the AccessTokenTemplate to use as defaults for this token.

    Template fields act as defaults — they are used when the corresponding field is absent from the request body. Any value you provide in the request, including an empty array, takes precedence.

    For example, if the template has scope: ['spend', 'transfer'] and you send scope: ['read'], the created token will have scope: ['read']. If you omit scope entirely, the token gets scope: ['spend', 'transfer'] from the template.

  • permittedEnterprises array of strings
  • permittedWallets array of strings

Responses

200
OK

Response Body

object

  • id string required

    matches ^[0-9a-f]{32}$

  • isExtensible boolean required
  • adminScope string enum
    readfull
  • bitgoAdminPermissions array of strings
  • client string
  • created string date-time
  • enterprise string
  • expires string date-time
  • extensionAddress string
  • ip string ipv4
    IP address of the client that requested this access token
  • ipRestrict array of strings
  • label string
  • origin string
    BitGo environment that issued this token
  • token string
  • scope array of strings
  • unlock object
    unlock object
    • spendingLimits map of objects
      spendingLimits object
      • <key> object
        value object
        • txCount number
          The transaction count limit for the coin
        • txValue number
          The transaction value limit for the coin
        • txValueLimit number
          The maximum transaction value limit for the coin
    • allErc20TokensLimit object
      allErc20TokensLimit object
      • enabled boolean required
        Indicates if the limit is enabled for all ERC20 tokens
      • txCount number required
        The transaction count limit for all ERC20 tokens
      • txValue string required
        The transaction value limit for all ERC20 tokens
      • txValueLimitInSmallUnits string
        The transaction value limit in small units for all ERC20 tokens
      • maxLimit boolean
        Indicates if the maximum limit is enabled
    • expires string date-time
    • time string date-time
    • txCount number
    • txValue number
    • txValueLimit number
  • user string

    matches ^[0-9a-f]{32}$

  • oauth object
    oauth object
    • oauthRequired boolean
    • expires string date-time
  • isMobileAccessToken boolean
    Flag indicating if this token was created via mobile session endpoint
400
Bad Request

Response Body

object

  • name string
    Error code
  • context map of objects required
    Properties that apply to a specific error name
    context object
    • <key> object
  • error string required
    Human-readable error message
  • requestId string required
    Client request id