Glossary · Authorization and APIs
What is a personal access token?
A personal access token is a long random string you create in an app's settings that lets your own scripts, CI jobs or servers call its API as you. You choose its scopes and expiry when you create it, send it as a bearer token, and revoke it at any time. It replaces a password for programmatic access.
Also called: PAT, API token
Personal access token, explained
OAuth is built for one app acting for many people. Often you only need your own automation to act for you: a nightly script that exports data, a CI step that files an issue when a build fails, a server-side job that syncs records. Running a full OAuth flow for that is overkill, and putting your password in a script is worse. A personal access token, often shortened to PAT, sits in between.
You create the token in settings, pick what it may do and how long it should live, and copy it once. The API sees the token in the Authorization: Bearer header and treats the request as you, limited to the token's scopes. If the token leaks, you revoke it without changing your password or affecting your other tokens.
Good practice is the same as for any secret. Give each token one job and the narrowest scopes it needs, set an expiry, keep it in an environment variable or a secret manager rather than in source code, and never ship it to a browser or a mobile app. A recognisable prefix helps: secret scanners can spot a leaked token in a public repository by its first few characters.
Tokens should also stay tied to the person. If someone leaves or loses access, their tokens should stop working at the same moment, not keep running on permissions frozen when they were created.
For example, a developer creates a token with work.write that expires in 90 days, stores it as a CI secret, and adds a step that calls the API to open a bug whenever the main branch fails to build. When the 90 days end, they create a new one.
How it works in Atrix
Atrix calls these Atrix Tokens. They start with atx_pat_, are shown once, and last 30 days, 90 days, a year or forever, as you choose. A token can never do more than the person who made it, and permissions are checked on every call, so removing someone's access disables their tokens immediately. Create and revoke them in Settings.
Read next
Related terms
- Scopes (OAuth scopes)Scopes are named permissions attached to an access token that limit what it can do, such as work.read or crm.write.
- OAuth 2.1OAuth 2.1 is the consolidated update to OAuth 2.0, the standard that lets an app act for a person without receiving their password.
- Rate limitA rate limit caps how many requests a client may make to an API in a period of time, such as 120 calls a minute.
- WebhookA webhook is an HTTP request a service sends to a URL you choose when something happens, such as a deal being won or an issue closing.