# Create a secret token (/api/auths/create-secret-auth)

`POST https://api.comecero.com/api/v1/auths/secret`

Creates a secret token for your server. The response is the only time you see the full token, so store it safely. Keep secret tokens on your server and never put one in a browser or an app. The new token is live unless you send `test=true` in the query string. The mode of the token you call with does not decide it: a test token that leaves out `test=true` asks for a live token and gets `403`. Give the token only the permissions it needs. It needs at least one role or one permission, and the token you call with must hold every permission you ask for. Secret and trusted tokens may call this with the `auths` create permission.

## Parameters

- `test` (query): `true` makes a test token, `false` or no value makes a live token. Only a live token may create a live token.
- `browser_info` (query): When `true`, the response also has `browser_info`.
- `timezone` (query): An IANA time zone name, such as `America/New_York` or `UTC`. It sets how `date_start` and `date_end` are read and the time zone of every date in the response. The default is the account's time zone (Settings, Technical), or UTC when it has none. A name that is not known is a `400`.

Request body: the `auth_secret_request` schema.

Responses: 201, 400, 401, 403, 500.

Full schemas: operation `create_secret_auth` in /openapi.json.