# Create a limited token (/api/auths/create-limited-auth)

`POST https://api.comecero.com/api/v1/auths/limited`

Creates a limited token for a shopper's browser. A limited token works like a session: it can read your public catalog, and it can change only the carts, payments and other objects it created itself. Call it without an `Authorization` header from the browser, with your `account_id` in the query string (`400` without it). The new token is live. To get a test token this way, add `test=true`. That works only when your account allows limited test tokens without a token (Settings, Technical, `allow_public_limited_test_tokens`); otherwise the answer is `403`. Your server may also call it with a secret or trusted token that may create tokens. Then `account_id` is optional (it must match the token, `400` otherwise), the new token takes the mode of your token unless you send `test`, and you may send a `customer_id` to make the token for one customer. A limited token in the header is refused (`403`): to get a new one, call without a header. A new limited token lasts two hours. Each use moves the expiry forward, and a token that keeps being used lasts longer: 12 hours for its first uses, 24 hours after 5 uses and 15 days after 10 uses.

## Parameters

- `account_id` (query): Your account ID. Required when you call without a token. With a token, it must match the token's account.
- `test` (query): `true` for a test token, `false` for a live one. Without a token the default is live. With a token the default is your token's mode.
- `browser_info` (query): When `true`, the response also has `browser_info`.
- `user_ip_address` (query): The shopper's IP address, when your server calls with a secret token on the shopper's behalf. Comecero uses it for fraud checks and to find the shopper's country. Only read for a secret token: for every other token the address the request comes from is used. A value that is not a valid IPv4 or IPv6 address is ignored.

Request body: the `auth_limited_request` schema.

Responses: 201, 400, 403, 404, 500.

Full schemas: operation `create_limited_auth` in /openapi.json.