Skip to main content

Personal access tokens

A personal access token (PAT) is a long-lived credential carrying your permissions. Use one wherever a browser session doesn't fit: CI uploading source maps, a script querying the API, an MCP client.

Create one​

Profile → Personal access tokens → New token. Give it a name that says where it will live ("gitlab-ci sourcemaps", "claude desktop").

GET    /api/v1/auth/tokens
POST   /api/v1/auth/tokens
DELETE /api/v1/auth/tokens/{id}

The full token (errora_pat_…) is shown once, at creation. Errora stores it hashed, plus a short prefix so you can recognize it in the list. Lost it? Delete and create a new one.

Use it​

curl -H "Authorization: Bearer errora_pat_…" \
     "$ERRORA/api/v1/organizations/$ORG_ID/projects"

MCP clients take the same header — see MCP server.

Scope and safety​

  • A PAT has the permissions of the account that made it, across every organization that account belongs to. There is no narrower scoping today, so create tokens from an account whose access matches the job.
  • Store it in your CI's secret store, never in the repository.
  • Revoke immediately if it leaks: delete the token, and any request using it fails at once.
  • Rotate CI tokens on a schedule you can live with; creating a new one and deleting the old is a two-minute change.

Troubleshooting​

SymptomCause / fix
401Wrong token, revoked token, or the Bearer prefix is missing
403The owning account lacks the capability on that organization/project
Works locally, fails in CIThe secret wasn't exposed to the job (protected variable on an unprotected branch is the classic one)