Secure your token

A Personal Access Token is a bearer credential. If another person or service gets it, they can use it until it expires or is revoked.

Store it safely#

• Use a secrets manager or deployment environment variable.
• Do not paste tokens into source code.
• Do not commit tokens to Git.
• Do not send tokens in chat, screenshots, or support tickets.

Reduce risk#

• Choose the narrowest scopes.
• Use shorter expiry for experiments.
• Create separate tokens per app or environment.
• Revoke tokens that are unused or no longer needed.

If a token leaks#

1. Revoke immediately

   Open Settings → API Tokens and revoke the exposed token.

2. Rotate downstream config

   Remove the old value from any deployment, secret store, or local environment.

3. Create a replacement

   Use only the scopes the client truly needs.

Team tokens#

When you create a token inside a Team workspace, the token is bound to that team context. Keep team tokens separate from personal automation.