**Personal Access Tokens (PATs)** are the recommended way to securely authenticate with Aurora APIs. They provide a simpler, more secure alternative to Service Accounts for programmatic access to Aurora resources.

With PATs, you can **create and manage API credentials** directly from the Aurora platform, **configure token expiration**, and **revoke or regenerate tokens** whenever needed.

Personal Access Tokens provide a modern authentication experience with **improved security and credential management**.

Key benefits include: - **Secure API authentication** using a dedicated access token. - **Configurable expiration** to limit the lifetime of credentials. - **Token regeneration and revocation** whenever credentials need to be rotated or replaced. - **Centralized credential management** directly from the Aurora platform. - **Simplified authentication** for applications, scripts, and integrations. - **Personalized authentication** using user-specific access tokens instead of shared Service Accounts. - **User-owned credentials** that can only be viewed and managed by the user who created them.

Before creating a Personal Access Token, ensure that: - You have access to an **Aurora account**. - You have **permission to access the APIs** required by your application. - You are **signed in** to the Aurora platform.

1. **Sign in** to Aurora. 2. Navigate to **Profile Settings → Personal Access Tokens**. 3. Select **Create Personal Access Token**. 4. Enter a **descriptive name** for the token. 5. Configure an **expiration date**, if required. 6. **Create** the token. 7. **Copy and securely store** the generated token.

A Personal Access Token can only perform actions that are **included in the token's configured scope** and are **already permitted by your Aurora role**. This means a PAT can never grant permissions beyond what the user already has.

The available PAT scopes for each role are summarized below:

Personal Access Tokens **always inherit the permissions** of the user who created them. For example: - If a **Project Viewer** creates a PAT with a Project Owner scope, the token will still only have **viewer access**. - If a user **loses access to a project**, all PATs created by that user **immediately lose access** as well. - Selecting **All Projects** grants access only to projects the user **currently has access to** and any future projects they are granted access to. It does **not** provide access to every project in the organization.

From the **Personal Access Tokens** page, you can: - **Create** additional tokens. - **View** tokens created by you, including creation and expiration dates. - **Revoke** tokens that are no longer needed or may have been compromised.

Revoked or expired tokens can **no longer be used** to authenticate API requests.

If your applications currently authenticate using a Service Account, **update them to use a Personal Access Token** before Service Accounts are deprecated.

**Migration steps:** 1. **Sign in** to Aurora. 2. Navigate to **Profile Settings → Personal Access Tokens**. 3. **Create** a new Personal Access Token. 4. **Update** your application or integration to authenticate using the new token. 5. **Verify** that authentication succeeds. 6. After confirming your integration is working, **discontinue** using your existing Service Account credentials.

We recommend completing the migration **as soon as possible** to avoid any interruption to your integrations.

To help keep your applications secure: - **Store tokens securely** using environment variables or a secrets manager. - **Never commit** Personal Access Tokens to source control. - **Create separate tokens** for different applications or environments. - **Configure expiration dates** whenever appropriate. - **Revoke tokens immediately** if they are no longer required or have been exposed. - **Rotate tokens periodically** as part of your organization's security practices.

**I lost my token:** For security reasons, Personal Access Tokens are shown only once when they are created. If you no longer have the token value, **revoke the existing token** and **create a new one**.

**Can I create multiple Personal Access Tokens?** Yes. You can create multiple tokens to support different applications, environments, or workflows.

**Can I change a token's expiration date?** If you need different expiration settings, regenerate or create a new token with the desired configuration.

**What happens when a token expires?** Expired tokens can no longer authenticate API requests. Create a new Personal Access Token to restore access.

**Do I still need a Service Account?** No. Personal Access Tokens are the recommended authentication mechanism for Aurora APIs. Existing Service Accounts will be deprecated and should be replaced with PATs.

After creating your Personal Access Token, **update your applications and integrations** to authenticate using the new token. This ensures continued access to Aurora APIs as Service Accounts are phased out.