Source: https://datafa.st/docs/api/website/bot-traffic/authentication-token/create
Markdown source: https://datafa.st/docs/api/website/bot-traffic/authentication-token/create.md
Description: Create a website-specific `dfbot_` request-authentication token. Creating it does not require incoming requests to use it; enable `requireAuthToken` only after the tracker has been updated.

# Create Bot traffic token

`POST https://datafa.st/api/v1/admin/websites/{websiteId}/bot-traffic/token`

Create a website-specific `dfbot_` request-authentication token. Creating it does not require incoming requests to use it; enable `requireAuthToken` only after the tracker has been updated.

The complete token is returned once in `requestAuthToken`. Store it immediately in a server-side secret. MCP equivalent: `datafast_bot_traffic_token_create`, with `confirm: true` required.

> **Related:** [Update Bot traffic settings](/docs/api/website/bot-traffic/settings/update) · [Bot traffic tracking](/docs/bot-traffic-tracking#optional-request-authentication)

## Request

#### Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `websiteId` | string | Yes | Website ObjectId used by account tokens to choose which website to query or manage. Website ObjectId. Get it from the dashboard or the List websites API. |

## Response

Returns a JSON object with `status: "success"` and endpoint-specific fields in `data` (and `pagination` when the endpoint is paginated).

#### Response fields

| Field | Type | Description |
| --- | --- | --- |
| `data[].websiteId` | string | Website ObjectId used by account tokens to choose which website to query or manage. |
| `data[].domain` | string | Tracked domain. |
| `data[].hasToken` | boolean | Whether a request-authentication token exists. |
| `data[].displayToken` | string\|null | Masked token display value, never the secret. |
| `data[].createdAt` | string\|null | When the current token was created. |
| `data[].requireAuthToken` | boolean | Whether incoming Bot traffic requests must include the token. |
| `data[].requestAuthToken` | string | Full new token. Returned once; store it immediately. |

## Authentication

Requires an owner `dft_` account token with `settings:write`. Website API keys (`df_`) cannot call this endpoint.

The token must be allowed to access the website in the path, and that website must belong to the token owner.

The account must have active DataFast API access. Read [authentication and scopes](/docs/api/authentication) for token creation and permissions.

### Errors

**400** — Invalid website ID.

**404** — Website not found or the caller is not its owner.

**409** — A token already exists; rotate it instead.

**500** — Token creation failed.

See [API errors](/docs/api#errors) for the standard error envelope, auth failures, validation errors, permission errors, and rate limits.

## Code examples

### Example request

```bash
curl -X POST "https://datafa.st/api/v1/admin/websites/{websiteId}/bot-traffic/token" \
  -H "Authorization: Bearer dft_xxx"
```

### Success response

```json
{
  "status": "success",
  "data": [{
    "websiteId": "665f0b3c4d2e1a0012345678",
    "domain": "example.com",
    "hasToken": true,
    "displayToken": "dfbot_abcd...wxyz",
    "createdAt": "2026-09-03T09:15:00.000Z",
    "requireAuthToken": false,
    "requestAuthToken": "dfbot_store-this-value-now"
  }]
}
```