How Personal Access Tokens work

A Personal Access Token signs you in to the TIR API in place of your account password. You use it in API calls, command-line tools, scripts, and CI/CD pipelines.

What a token is

• Each token has two values. You see the Auth Token when you create the token and again in the list. The API key is only in the token’s config file. An API call sends both; see Use a token in API calls.
• A token belongs to one project. The list shows the tokens you created in the project you have open.
• You can have many tokens. Make a separate one for each tool, environment, or machine, with a name that says what it is for, and manage each one separately.
• A token works for 365 days, and the Expiry column shows the date. Make a new token before then.
• Deleting a token revokes only that token. Your password, your other tokens, and your signed-in sessions stay as they are.
• Changing the account’s primary email address removes the tokens of the projects the account owns, so create new ones afterwards.

Keep tokens safe

• Name a token for its job or machine, such as github-actions or macbook-pro. Create one token per integration, so deleting one leaves the others as they are.
• Keep tokens out of source code and version control. Store them in an environment variable or a secret manager, and treat the config file the same way.
• Rotate tokens regularly: create a new one under a new name, switch what uses it, then delete the old one. Delete tokens that sit unused.

To create or delete a token, see Create a token and Delete a token.