# Personal access tokens

> https://docs.errora.org/en/account/tokens

A personal access token (PAT) is a long-lived credential carrying **your** permissions. Use
one wherever a browser session doesn't fit: CI uploading source maps, a script querying the
API, an [MCP client](/en/products/mcp).

## Create one

**Profile → Personal access tokens → New token**. Give it a name that says where it will
live ("gitlab-ci sourcemaps", "claude desktop").

```text
GET    /api/v1/auth/tokens
POST   /api/v1/auth/tokens
DELETE /api/v1/auth/tokens/{id}
```

The full token (`errora_pat_…`) is shown **once**, at creation. Errora stores it hashed, plus
a short prefix so you can recognize it in the list. Lost it? Delete and create a new one.

## Use it

```bash
curl -H "Authorization: Bearer errora_pat_…" \
     "$ERRORA/api/v1/organizations/$ORG_ID/projects"
```

MCP clients take the same header — see [MCP server](/en/products/mcp).

## Scope and safety

- A PAT has **the permissions of the account that made it**, across every organization that
  account belongs to. There is no narrower scoping today, so create tokens from an account
  whose access matches the job.
- Store it in your CI's secret store, never in the repository.
- Revoke immediately if it leaks: delete the token, and any request using it fails at once.
- Rotate CI tokens on a schedule you can live with; creating a new one and deleting the old
  is a two-minute change.

## Troubleshooting

| Symptom | Cause / fix |
| --- | --- |
| `401` | Wrong token, revoked token, or the `Bearer ` prefix is missing |
| `403` | The owning account lacks the capability on that organization/project |
| Works locally, fails in CI | The secret wasn't exposed to the job (protected variable on an unprotected branch is the classic one) |