Open Tokens (/tokens) as admin.
- Name the token (display only).
- Pick a role:
admin,operator, orreadonly. - Create. Copy the secret immediately.
Stored as SHA-256. token_prefix is what you see later in the list. You cannot recover the full secret.
operator is helpdesk: reservations and force-release. Other writes 403. readonly cannot mutate.
Token-create is rate-limited (tighter than the 300/min API cap). Do not put the token in query strings or logs. Do not enable Access-Control-Allow-Origin: *. XSS on the Lattice origin can still read sessionStorage — treat the console host like a secret.
API create (lab, before any token exists):
curl -s -X POST http://127.0.0.1:8080/api/v1/tokens \
-H 'content-type: application/json' \
-d '{"name":"admin","role":"admin"}'