Personal Access Tokens

Personal access tokens (PATs) allow individual users to authenticate with the RAMP API without using their regular login credentials. Each token inherits the permissions of the user who created it.

Accessing Token Management

Navigate to Settings > Personal Access Tokens (or /_settings/tokens).

Note

Unlike most administration features, personal access tokens are managed by individual users, not by administrators. Any authenticated user can create and manage their own tokens.

When to Use Personal Access Tokens

Personal access tokens are useful for:

Use Case	Description
Personal scripts	Automating tasks with scripts that run under your identity
Development tools	Connecting IDE plugins or development tools to the RAMP API
Testing	Quick API testing during development without full OAuth flows
Ad-hoc integrations	Short-lived integrations that do not warrant a dedicated service account

PATs vs. Service Accounts

Feature	Personal Access Tokens	Service Accounts
Identity	Tied to an individual user	Independent machine identity
Permissions	Inherits the user’s roles	Assigned independently
Management	Managed by the user	Managed by Administrators
Best for	Personal scripts, development	Production integrations, CI/CD
Lifecycle	Tied to the user’s account	Independent of any user

Tip

For production integrations and automated pipelines, use service accounts instead of personal access tokens. Service accounts are independent of individual users and are managed centrally by administrators.

Creating a Token

1. Navigate to Settings > Personal Access Tokens.
2. Click Create Token.
3. Enter a Name that describes the token’s purpose (e.g., “CLI Script”, “Postman Testing”, “VS Code Plugin”).
4. Optionally set an Expiration Date. Tokens without an expiration date remain valid until manually revoked.
5. Click Create.
6. Copy the generated token immediately and store it securely.

Danger

The token value is displayed only once at creation time. Copy it immediately and store it in a secure location (e.g., a password manager or secrets vault). If you lose the token, you will need to create a new one.

Using a Token

Include the personal access token in the Authorization header of your API requests:

Authorization: Bearer <your-token>

The token authenticates as the user who created it, with the same permissions and role access.

Managing Tokens

Viewing Your Tokens

The token management page lists all your active tokens with:

• Token name
• Creation date
• Expiration date (if set)
• Last used date

Note

The actual token values are never displayed after creation. Only the token name and metadata are shown.

Revoking a Token

If a token is compromised or no longer needed:

1. Navigate to Settings > Personal Access Tokens.
2. Find the token you want to revoke.
3. Click Revoke (or Delete).
4. Confirm the action.

Revoked tokens are immediately invalidated. Any API call using the revoked token will be rejected.

Caution

Revoking a token is immediate and irreversible. Ensure no active scripts or tools depend on the token before revoking it, or update them with a new token first.

Token Permissions

A personal access token inherits all the permissions of the user who created it at the time of each API call. This means:

• If your roles change (added or removed), the token’s effective permissions change accordingly.
• If your account is deactivated, the token stops working.
• The token cannot access more than you can access through the UI.

Note

There is no way to create a token with a subset of your permissions. The token always has the full set of permissions associated with your user account.

Security Best Practices

• Use descriptive names — name each token after its purpose so you know which to revoke if needed.
• Set expiration dates — avoid indefinite tokens. Set expiration dates appropriate for the use case.
• One token per use case — create separate tokens for different tools or scripts. This allows you to revoke access for one tool without affecting others.
• Never commit tokens — do not store tokens in source code, configuration files checked into version control, or documentation.
• Rotate periodically — regenerate tokens on a regular schedule, especially those with broad permissions.
• Revoke unused tokens — regularly review your tokens and revoke any that are no longer in use.
• Use environment variables — store tokens in environment variables or secret management tools, not in plain text files.

Related topics

Service Accounts Create service accounts for API automation and external system integrations