Secure your token
Store PATs safely and limit blast radius.
A Personal Access Token is a bearer credential. If another person or service gets it, they can use it until it expires or is revoked.
Store it safely#
- Use a secrets manager or deployment environment variable.
- Do not paste tokens into source code.
- Do not commit tokens to Git.
- Do not send tokens in chat, screenshots, or support tickets.
Reduce risk#
- Choose the narrowest scopes.
- Use shorter expiry for experiments.
- Create separate tokens per app or environment.
- Revoke tokens that are unused or no longer needed.
If a token leaks#
Revoke immediately
Open Settings → API Tokens and revoke the exposed token.Rotate downstream config
Remove the old value from any deployment, secret store, or local environment.
Create a replacement
Use only the scopes the client truly needs.
Team tokens#
When you create a token inside a Team workspace, the token is bound to that team context. Keep team tokens separate from personal automation.