Personal Access Tokens
3 minute read
Use Personal Access Tokens for development or testing purposes only.
For production use cases, RudderStack recommends using the following over a Personal Access Token:
- Workspace-level Service Access Tokens for working with workspace-level resources and APIs
- Organization-level Service Access Tokens for working with SSO SCIM, the Audit Log API, and the Organization Usage API.
This guide explains the concept of Personal Access Tokens in RudderStack’s Access Management system. It also describes the steps to generate a Personal Access Token and all the operations associated with it.
Overview
To consume the public RudderStack APIs, you need a Personal Access Token (PAT). This access token is associated with an individual’s RudderStack account.
Permissions
You can create and use Personal Access Tokens with the following scopes:
| Token scope | Description |
|---|---|
| Read-Only | Access tokens will have read-only permissions. |
| Read-Write | Access tokens will have both read-only and read-write permissions of the user.
|
| Admin |
|
Personal Access Tokens vs. Service Access Tokens
| Personal Access Tokens (PAT) | Service Access Tokens (SAT) |
|---|---|
| Tied to a specific user within a workspace. | Not tied to an individual user. |
| Used for individual tasks and testing. | Used for centralized, shared access and production use cases. |
| Any processes dependent on these tokens will break if the user is removed from the organization or a breaking change is made to their permissions. | Exist at an organization or workspace level, ensuring continuity in essential workflows and pipelines using these tokens. |
Generate Personal Access Token
- Log in to your RudderStack dashboard.
- Go to Settings > Your Profile and scroll down to Personal Access Tokens. Then, click Generate new token:
- Enter the Token name, select the Workspace and the Scope from the respective dropdowns:
- Click Generate.
- Note the Personal Access Token value.
Make sure to secure the generated token — the token value is not visible again once you close this window.
Delete Personal Access Token
- Go to Settings > Your Profile and scroll down to Personal Access Tokens.
- Click the Delete option next to the token and confirm by clicking Yes, delete.
Migrate old Personal Access Tokens
After migration, Personal Access Tokens:
- Inherit user permissions: Personal Access Tokens continue to inherit the permissions of the user who created them. Since user permissions are migrated to their Member Workspace Policy, Personal Access Tokens automatically reflect those permissions.
- Maintain scope behavior: Personal Access Tokens created with Read-Only or Read-Write scopes continue to work as before, with their effective permissions determined by the user’s Individual Workspace Policy.
See the Migration Scenarios guide for detailed examples of how Personal Access Tokens are migrated to the new Access Management system.
