# Create Installation Access Token

Part of [Apps and installations](https://cursor.com/docs/api/origin/reference/apps-and-installations.md) in the Origin API reference.

POST

`/v1/origin/app/installations/{installationId}/access_tokens`

Requires no scope (app JWT).

Creates an installation access token for the authenticated app.

Requires app signing-JWT authentication, like GetAuthenticatedApp. The token is scoped to the named installation, which must belong to the authenticated app. Callers may attenuate the token to a subset of the installation's accepted scopes and accessible repositories.

`repositoryIds` can name a mirrored repository. The resulting token carries the installation's scopes, and Origin still applies the mirror ceiling on each request: see [Mirrored repositories](https://cursor.com/docs/api/origin/reference/mirrored-repositories.md).

## Path Parameters

`installationId` string Required

The unique identifier of the installation to scope the token to. Bound from the URL path; the installation must belong to the authenticated app.

## Request Body

`scopes` array

Scope strings to grant the token. Values must be unique and included in the installation's accepted scopes. Empty or omitted inherits the full scope grant.

`repositoryIds` array

Repository IDs to grant the token. Values must be unique, accessible to the installation, and contain at most 50 entries. Empty or omitted inherits all accessible repositories.

## Response Fields

`token` string

Short-lived installation credential with the oit\_ prefix.

`expiresAt` string

RFC 3339 expiration time; the token expires after at most 15 minutes and never outlives the app JWT used to mint it.

```bash
curl --request POST \
  --url 'https://api.cursor.com/v1/origin/app/installations/INSTALLATION_ID/access_tokens' \
  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "scopes": [
    "repository:contents:read",
    "repository:pull_requests:read"
  ],
  "repositoryIds": [
    "repo_01k2ja2000e0080000000000q4"
  ]
}'
```

**Response shape:**

```json
{
  "token": "oit_2v8xkq4m1c7p9t3w5y0z6r4b",
  "expiresAt": "2026-08-01T10:30:00Z"
}
```


---

## Sitemap

[Origin API docs index](https://cursor.com/docs/api/origin/llms.txt)