# Manage Personal Access Tokens in Agility

> Source: https://agilitycms.com/docs/developers/manage-personal-access-tokens

A Personal Access Token (PAT) lets the [Agility CLI](/docs/developers/cli), your own scripts and a CI pipeline call the Management API as you, without a browser sign-in. You can create, rename, disable, enable and delete your tokens in Agility, from your profile menu. For what a token can and can't do, see [Personal Access Tokens](/docs/developers/personal-access-tokens).

## Before you start

- **Use the account the token should act as.** A token has the same permissions as the user who creates it, on every instance that user can reach. For a shared pipeline, sign in as a dedicated automation user rather than a person.
- **You need the Develop or Manage permission** on the instance you have open. Without it, *Personal Access Tokens* doesn't appear in your profile menu. Open an instance where you have it. The tokens themselves aren't tied to that instance.

## Open your tokens

1. Select your avatar in the top-right corner of Agility.
2. Select **Personal Access Tokens**.

The list shows every token you've created, whichever instance you open it from. Each token shows when it was created, when it expires and when it was last used, and its status: **Enabled**, **Disabled** or **Expired**. A token that expires within seven days says so.

![The profile menu in Agility, with Personal Access Tokens between Timezone and Language and Open in Classic UI](https://cdn.aglty.io/agility-cms-docs/images/developer/manage-personal-access-tokens-profile-menu.png)

![The Personal Access Tokens window, listing one disabled and one enabled token with their created and expiry dates](https://cdn.aglty.io/agility-cms-docs/images/developer/manage-personal-access-tokens-list.png)

## Create a token

1. Select **Create Token**.
2. In **Name**, say where the token will be used, for example `CI pipeline` or `Nightly content sync`. Names are up to 100 characters, and each of your tokens needs a different name.
3. In **Expiration**, choose how long the token lasts: 30 days, 90 days (the default), 6 months, 1 year or 2 years.
4. Select **Create Token**.
5. Select **Copy Token**, and store the token somewhere safe, such as your CI system's secrets or a password manager.
6. Select **Done**.

> [!WARNING]
> This is the only time Agility shows the token. If you lose it, delete the token and create a new one.

![The Create Personal Access Token dialog, with a Name field and an Expiration list set to 90 days](https://cdn.aglty.io/agility-cms-docs/images/developer/manage-personal-access-tokens-create.png)

![The Personal Access Token Created dialog, showing the new token (blurred here) with Copy Token and Done buttons](https://cdn.aglty.io/agility-cms-docs/images/developer/manage-personal-access-tokens-created.png)

## Use the token

With the Agility CLI, pass the token as `--token` or set `AGILITY_TOKEN`:

```bash
AGILITY_TOKEN="<your token>" agility pull --sourceGuid="<instance guid>" --headless
```

Your own scripts and the [Management SDK](/docs/javascript/management-sdk/getting-started) send it in the `Authorization` header, as `Bearer <your token>`. For pipelines, see the [CLI CI/CD Integration Guide](/docs/developers/cli-ci-cd-integration-guide).

## Rename a token

1. Hover over the token and select **Rename** (the pencil icon).
2. Enter the new name and select **Save**.

Renaming doesn't change the token's value or its expiry date, so anything using it keeps working.

## Disable or enable a token

Hover over the token and select **Disable** (the pause icon). Anything using the token stops working until you enable it again with **Enable** (the play icon).

Disabling is useful when you think a token may have leaked, or to check that nothing still uses it before you delete it. A disabled token doesn't count towards your limit of 10 active tokens.

An expired token can't be enabled again. Create a new one.

## Delete a token

1. Hover over the token and select **Delete** (the trash icon).
2. Select **Delete** to confirm.

Anything using the token stops working straight away, and you can't undo it.

![The Delete Personal Access Token confirmation, warning that anything using the token stops working immediately](https://cdn.aglty.io/agility-cms-docs/images/developer/manage-personal-access-tokens-delete.png)

## Limits

| Limit | Value |
| --- | --- |
| Active tokens per user | 10. Disabled and expired tokens don't count |
| Longest expiry | 2 years |
| Tokens created | 5 an hour |

When you have 10 active tokens, **Create Token** is unavailable. Disable or delete a token you don't need first.

## Troubleshooting

| What you see | What to do |
| --- | --- |
| *Personal Access Tokens* isn't in your profile menu | You need the Develop or Manage permission on the instance you have open. Open another instance, or ask an admin |
| **Create Token** is greyed out | You have 10 active tokens. Disable or delete one |
| An error about too many requests when you create a token | You've created 5 tokens in the last hour. Wait, then try again |
| A script gets `401` with a token that used to work | The token has expired, been disabled or deleted, or the user who created it has been suspended or removed. Check its status in the list |

## Related

- [Personal Access Tokens](/docs/developers/personal-access-tokens): what tokens are and the rules that apply to them
- [Create a Personal Access Token with the API](/docs/developers/create-personal-access-token): create and manage tokens from a terminal
- [CLI CI/CD Integration Guide](/docs/developers/cli-ci-cd-integration-guide)

---

## Related pages

- [Content Fetch API](https://agilitycms.com/docs/developers/content-fetch-api.md)
- [Content Sync API](https://agilitycms.com/docs/developers/content-sync-api.md)
- [Content Management API](https://agilitycms.com/docs/developers/content-management-api.md)
- [GraphQL API](https://agilitycms.com/docs/developers/graphql-api.md)
- [CLI - CI/CD Integration Guide](https://agilitycms.com/docs/developers/cli-ci-cd-integration-guide.md)
- [Testing on Swagger](https://agilitycms.com/docs/developers/testing-on-swagger.md)
- [GraphQL & Rest API Filtering](https://agilitycms.com/docs/developers/graphql-operators.md)
- [AgilityCLI (Command Line Interface)](https://agilitycms.com/docs/developers/cli.md)
- [Personal Access Tokens](https://agilitycms.com/docs/developers/personal-access-tokens.md)
- [Content Delivery & CDN Architecture](https://agilitycms.com/docs/developers/content-delivery-and-cdn-architecture.md)
- [Typed GraphQL with TypeScript and Next.js](https://agilitycms.com/docs/developers/typed-graphql-typescript-nextjs.md)
- [Image Transformation Reference](https://agilitycms.com/docs/developers/image-transformation-reference.md)
- [Fetch API Status Codes and Caching](https://agilitycms.com/docs/developers/fetch-api-status-codes-and-caching.md)
- [Field Types and What the APIs Return](https://agilitycms.com/docs/developers/field-types-api-reference.md)
- [Content Sync Explained](https://agilitycms.com/docs/developers/content-sync-explained.md)
- [Agility CLI Command Reference](https://agilitycms.com/docs/developers/cli-reference.md)
- [CLI Reference: agility pull](https://agilitycms.com/docs/developers/cli-pull.md)
- [CLI Reference: agility sync and push](https://agilitycms.com/docs/developers/cli-sync.md)
- [CLI Reference: agility reverse-sync](https://agilitycms.com/docs/developers/cli-reverse-sync.md)
- [CLI Reference: agility workflows](https://agilitycms.com/docs/developers/cli-workflows.md)
- [CLI Reference: agility login and logout](https://agilitycms.com/docs/developers/cli-login-logout.md)
- [Test Your Agility Integration in CI](https://agilitycms.com/docs/developers/test-agility-integration-in-ci.md)
- [CLI Reference: agility verify](https://agilitycms.com/docs/developers/cli-verify.md)
- [Create a Personal Access Token with the API](https://agilitycms.com/docs/developers/create-personal-access-token.md)

Index of every docs page: https://agilitycms.com/docs/llms.txt