> ## Documentation Index
> Fetch the complete documentation index at: https://docs.octavehq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate Asset Access Token

> Mint a per-user access token for the artifacts service, scoped to the calling user and workspace. The token authenticates direct calls to the artifacts service — including asset creation/upload (multipart POST /api/v1/artifacts/ on the artifacts host), which has no /api/v2 proxy. Returns the plaintext token, which is shown ONLY here and on refresh — store it securely, it cannot be retrieved again. One token is active per user and workspace: calling again rotates it and invalidates the previous one, and other Octave surfaces acting as the same user (the in-app asset gallery, MCP tools) may rotate yours. Treat a 401 from the artifacts service as "generate again and retry once".



## OpenAPI

````yaml post /api/v2/asset/access-token/generate
openapi: 3.0.0
info:
  version: 1.0.0
  title: Octave API
  description: API for Octave workspace management and AI-powered content generation
servers:
  - url: https://app.octavehq.com
security:
  - ApiKeyAuth: []
paths:
  /api/v2/asset/access-token/generate:
    post:
      tags:
        - Asset
      summary: Generate Asset Access Token
      description: >-
        Mint a per-user access token for the artifacts service, scoped to the
        calling user and workspace. The token authenticates direct calls to the
        artifacts service — including asset creation/upload (multipart POST
        /api/v1/artifacts/ on the artifacts host), which has no /api/v2 proxy.
        Returns the plaintext token, which is shown ONLY here and on refresh —
        store it securely, it cannot be retrieved again. One token is active per
        user and workspace: calling again rotates it and invalidates the
        previous one, and other Octave surfaces acting as the same user (the
        in-app asset gallery, MCP tools) may rotate yours. Treat a 401 from the
        artifacts service as "generate again and retry once".
      operationId: generateAccessToken
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties: {}
      responses:
        '200':
          description: Asset access token generated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  _metadata:
                    $ref: '#/components/schemas/Metadata'
                  data:
                    type: object
                    properties:
                      accessToken:
                        type: string
                        description: >-
                          Plaintext per-user access token — returned ONLY here
                          and on refresh; store it, it cannot be retrieved
                          again. e.g. 'atk_7f3c9d2b8a...'
                      prefix:
                        type: string
                        description: >-
                          Short non-secret prefix identifying the token (safe to
                          display/log). e.g. 'atk_7f3c'
                      expiresAt:
                        type: string
                        description: >-
                          ISO-8601 expiry, ~30 days out. e.g.
                          '2026-08-02T09:00:00.000Z'
                    required:
                      - accessToken
                      - prefix
                      - expiresAt
                required:
                  - _metadata
                  - data
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                type: object
                properties:
                  _metadata:
                    $ref: '#/components/schemas/Metadata'
                required:
                  - _metadata
      deprecated: false
components:
  schemas:
    Metadata:
      type: object
      properties:
        usage:
          type: number
          default: 0
          example: 0
          description: API usage
        requestId:
          type: string
          example: requestId
          description: Request ID
        message:
          type: string
          example: message
          description: Message
        timestamp:
          type: string
          example: '2021-01-01T00:00:00.000Z'
          description: Timestamp
      required:
        - requestId
        - timestamp
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: api_key

````