Personal Access Tokens
Mint and revoke headless bearer credentials for CLI, MCP, and CI callers.
3 tools
# list_personal_access_tokens
List your personal access tokens (metadata only — hashes never exposed). Identity comes from the authenticated session.
# create_personal_access_token
Mint a new personal access token for headless authentication (CLI, MCP, CI). The raw token is returned exactly once — capture it immediately. Token is owned by the calling user.
| Parameter | Type | Required | Description |
|---|---|---|---|
| name | string | ● | Human-readable label, e.g. 'claude-code'. Surfaces as the agent_id on every audit row written with this token. |
| ttl_seconds | integer | — | Optional expiry in seconds. Omit (or 0) for a token that never expires. |
# revoke_personal_access_token
Revoke a personal access token by id. Effective immediately. You can only revoke tokens you own.
| Parameter | Type | Required | Description |
|---|---|---|---|
| id | string | ● | Token id (from list_personal_access_tokens). |