# Personal Access Tokens

Use Personal Access Tokens for development or testing purposes only.

For production use cases, RudderStack recommends using the following over a Personal Access Token:

Workspace-level Service Access Tokens for working with workspace-level resources and APIs

Organization-level Service Access Tokens for working with SSO SCIM, the Audit Log API, and the Organization Usage API.

This guide explains the concept of Personal Access Tokens in RudderStack’s Access Management system. It also describes the steps to generate a Personal Access Token and all the operations associated with it.

Overview

To consume the public RudderStack APIs, you need a Personal Access Token (PAT). This access token is associated with an individual’s RudderStack account.

Permissions

You can create and use Personal Access Tokens with the following scopes:

Token scope	Description
Read-Only	Access tokens will have read-only permissions.
Read-Write	Access tokens will have both read-only and read-write permissions of the user. If a user having read-only permissions creates a Read-Write token, then the token will still have read-only permissions.
Admin	Creation of new Personal Access Tokens with Admin scope is deprecated. However, any existing Admin PATs will continue to work as before, even after migration.

Personal Access Tokens vs. Service Access Tokens

Personal Access Tokens (PAT)	Service Access Tokens (SAT)
Tied to a specific user within a workspace.	Not tied to an individual user.
Used for individual tasks and testing.	Used for centralized, shared access and production use cases.
Any processes dependent on these tokens will break if the user is removed from the organization or a breaking change is made to their permissions.	Exist at an organization or workspace level, ensuring continuity in essential workflows and pipelines using these tokens.

Generate Personal Access Token

Log in to your RudderStack dashboard.
Go to Settings > Your Profile and scroll down to Personal Access Tokens. Then, click Generate new token:

New Personal Access Token in RudderStack dashboard

Enter the Token name, select the Workspace and the Scope from the respective dropdowns:

Click Generate.
Note the Personal Access Token value.

Make sure to secure the generated token — the token value is not visible again once you close this window.

Delete Personal Access Token

Go to Settings > Your Profile and scroll down to Personal Access Tokens.
Click the Delete option next to the token and confirm by clicking Yes, delete.

Migrate old Personal Access Tokens

After migration, Personal Access Tokens:

Inherit user permissions: Personal Access Tokens continue to inherit the permissions of the user who created them. Since user permissions are migrated to their Member Workspace Policy, Personal Access Tokens automatically reflect those permissions.
Maintain scope behavior: Personal Access Tokens created with Read-Only or Read-Write scopes continue to work as before, with their effective permissions determined by the user’s Individual Workspace Policy.

See the Migration Scenarios guide for detailed examples of how Personal Access Tokens are migrated to the new Access Management system.