---
title: "How Personal Access Tokens work"
description: "What a Personal Access Token is, what belongs to a token, when it stops working, and how to keep tokens safe."
content_type: "concept"
product: "personal-access-tokens"
platform: "TIR"
url: "/tir/personal-access-tokens/concepts/how-personal-access-tokens-work/"
topic: ["tokens"]
---

# How Personal Access Tokens work

A Personal Access Token signs you in to the TIR API in place of your account password. You use it in API calls,
command-line tools, scripts, and CI/CD pipelines.

## What a token is

- Each token has two values. You see the **Auth Token** when you create the token and again in the list. The
  API key is only in the token's config file. An API call sends both; see
  [Use a token in API calls](/tir/personal-access-tokens/how-to/use-a-token-in-api-calls/).
- A token belongs to one project. The list shows the tokens you created in the project you have open.
- You can have many tokens. Make a separate one for each tool, environment, or machine, with a name that
  says what it is for, and manage each one separately.
- A token works for 365 days, and the **Expiry** column shows the date. Make a new token before then.
- Deleting a token revokes only that token. Your password, your other tokens, and your signed-in sessions
  stay as they are.
- Changing the account's primary email address removes the tokens of the projects the account owns, so
  create new ones afterwards.

## Keep tokens safe

- Name a token for its job or machine, such as `github-actions` or `macbook-pro`. Create one token per
  integration, so deleting one leaves the others as they are.
- Keep tokens out of source code and version control. Store them in an environment variable or a secret
  manager, and treat the config file the same way.
- Rotate tokens regularly: create a new one under a new name, switch what uses it, then delete the old one.
  Delete tokens that sit unused.

To create or delete a token, see [Create a token](/tir/personal-access-tokens/how-to/create-a-personal-access-token/)
and [Delete a token](/tir/personal-access-tokens/how-to/delete-a-personal-access-token/).