Personal Access Tokens

Personal Access Tokens (PATs) are the recommended way to securely authenticate with Aurora APIs. They provide a simpler, more secure alternative to Service Accounts for programmatic access to Aurora resources.

With PATs, you can create and manage API credentials directly from the Aurora platform, configure token expiration, and revoke or regenerate tokens whenever needed.

Why use Personal Access Tokens?

Personal Access Tokens provide a modern authentication experience with improved security and credential management.

Key benefits include:

• Secure API authentication using a dedicated access token.

• Configurable expiration to limit the lifetime of credentials.

• Token regeneration and revocation whenever credentials need to be rotated or replaced.

• Centralized credential management directly from the Aurora platform.

• Simplified authentication for applications, scripts, and integrations.

• Personalized authentication using user-specific access tokens instead of shared Service Accounts.

• User-owned credentials that can only be viewed and managed by the user who created them.

Create a Personal Access Token

Role-based scope

A Personal Access Token can only perform actions that are included in the token's configured scope and are already permitted by your Aurora role. This means a PAT can never grant permissions beyond what the user already has.

The available PAT scopes for each role are summarized below:

Aurora Role	Available PAT Scope	Description
Organization Admin	Organization Manager, Project Owner, Project Manager, Project Viewer	Can create PATs with organization-level management permissions and optionally grant project-level access across all accessible projects or selected projects. Organization Owner permissions cannot be assigned to a PAT.
Organization Member	Project Owner, Project Manager, Project Viewer (based on assigned permissions)	Can create PATs only for the projects and permissions they already have access to. A PAT cannot expand access to additional organizations or projects.
Project Owner	Project Owner	Can create PATs with full access to projects they own or have been granted access to. Tokens may be scoped to all accessible projects or specific projects.
Project Viewer	Project Viewer	Can create read-only PATs for projects they can already view. Tokens cannot modify or delete project resources.

Scope limitations

Personal Access Tokens always inherit the permissions of the user who created them. For example:

• If a Project Viewer creates a PAT with a Project Owner scope, the token will still only have viewer access.

• If a user loses access to a project, all PATs created by that user immediately lose access as well.

• Selecting All Projects grants access only to projects the user currently has access to and any future projects they are granted access to. It does not provide access to every project in the organization.

Managing Personal Access Tokens

From the Personal Access Tokens page, you can:

• Create additional tokens.

• View tokens created by you, including creation and expiration dates.

• Revoke tokens that are no longer needed or may have been compromised.

Revoked or expired tokens can no longer be used to authenticate API requests.

We recommend completing the migration as soon as possible to avoid any interruption to your integrations.

Security best practices

To help keep your applications secure:

• Store tokens securely using environment variables or a secrets manager.

• Never commit Personal Access Tokens to source control.

• Create separate tokens for different applications or environments.

• Configure expiration dates whenever appropriate.

• Revoke tokens immediately if they are no longer required or have been exposed.

• Rotate tokens periodically as part of your organization's security practices.

Troubleshooting

I lost my token: For security reasons, Personal Access Tokens are shown only once when they are created. If you no longer have the token value, revoke the existing token and create a new one.

Frequently Asked Questions

Can I create multiple Personal Access Tokens?

Yes. You can create multiple tokens to support different applications, environments, or workflows.

Can I change a token's expiration date?

If you need different expiration settings, regenerate or create a new token with the desired configuration.

What happens when a token expires?

Expired tokens can no longer authenticate API requests. Create a new Personal Access Token to restore access.

Do I still need a Service Account?

No. Personal Access Tokens are the recommended authentication mechanism for Aurora APIs. Existing Service Accounts will be deprecated and should be replaced with PATs.