# Create an operation token

`POST https://api.parklio.com/v2/operation-tokens`

Creates a token that lets **your app** operate one product over Bluetooth, through the Parklio SDK, during a time window. Pass `token_open`, `token_close` and `token_status` to the app unchanged.

- Send `end_time`, in the future and after `start_time`. `start_time` may be in the past.
- **Revoking doesn't reach the device:** a token works until `end_time` even if you block or delete it. Create tokens just in time, with short windows, and avoid `is_unlimited` (valid until 2038).
- Needs no plan feature and no Gateway.

See the [Operation tokens for your app](/guides/mobile-app-operation-tokens) guide.

**Auth:** `Authorization: Bearer <token>`

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `start_time` | string | yes | The starting time for the operation token |
| `end_time` | string | no | The end time for the operation token |
| `product_id` | number | yes | The product id to controll with the operation token |
| `is_unlimited` | number | no | Should the operation key be unlimited |

```json
{
  "start_time": "2026-01-15T09:30:00.000Z",
  "end_time": "2026-01-15T09:30:00.000Z",
  "product_id": 0,
  "is_unlimited": 0
}
```

## Responses

### 200

```json
{
  "success": true,
  "data": {
    "id": 9001,
    "product_id": 123,
    "start_time": "2026-03-02T08:00:00.000Z",
    "end_time": "2026-03-02T10:00:00.000Z",
    "status": "active",
    "used_count": 0,
    "is_unlimited": 0,
    "token_open": {
      "token": "<hex>",
      "status_key": "<hex>",
      "challenge_key": "<hex>"
    },
    "token_close": {
      "token": "<hex>",
      "status_key": "<hex>",
      "challenge_key": "<hex>"
    },
    "token_status": {
      "token": "<hex>",
      "status_key": "<hex>",
      "challenge_key": "<hex>"
    },
    "product": {
      "id": 123,
      "device_id": "B1234567"
    },
    "created_at": "2026-03-02T07:59:58.000Z",
    "updated_at": "2026-03-02T07:59:58.000Z"
  }
}
```

### 401 — Account user is not logged in and they should log in again.

```json
{
  "success": false,
  "errors": [
    {
      "code": 1,
      "message": "Unauthorized access."
    }
  ]
}
```

### 404 — Resource that has been requested does not exist. User should not try to repeat this request.

```json
{
  "success": false,
  "errors": [
    {
      "code": 6,
      "message": "Resource not found."
    }
  ]
}
```

### 422 — Some of the provided request parameters are missing or are invalid. User should add/change them according to response message.

```json
{
  "success": false,
  "errors": [
    {
      "code": 23,
      "message": "Validation error",
      "field": "field"
    }
  ]
}
```