A personal access token is how a tool acts as you outside the browser — connecting an AI assistant to Hodoflow, or running a script from your own machine. It reaches every organization you belong to and can do exactly what you can do, no more.
That includes building. An assistant holding your token can create data models, build and turn on workflows, and put dashboards together — the same work you do in Hodoflow, in any organization you are a member of. Treat the value the way you treat your password.
Outcome
You have one token you can paste into a tool, and a one-click way to replace it if it ever leaks.
Before you start
Your token lives on your own profile, reached from the account menu. Nobody else can see it — not your organization's owners, not support. If you lose the value, no one can look it up for you.
If the thing that needs access is a machine rather than you — a webhook sender, a scheduled script your team owns, an embedded dashboard — use a service account instead. Those belong to the organization and survive you leaving it.
1. Create your token
Open your profile, find Personal access token, and select Create token. That is the whole step — there is nothing to name or configure, because you have exactly one.
The value appears once. Copy it immediately and paste it into the tool that needs it. Closing the page or reloading it is enough to lose the value forever; if that happens, rotate and use the new one.
Tokens do not expire on a schedule. Yours keeps working until you rotate or expire it, so nothing breaks at 3am because a date passed.
2. Use it
Most tools ask for a bearer token. For an AI assistant, see Connect an AI assistant on the developer portal, which has the exact command for Claude and the list of what an assistant can do.
3. Rotate when you want a new value
Rotate issues a new token and kills the old value in the same moment. Use it when:
- you pasted the token somewhere public;
- a machine that held it was lost, sold, or handed on; or
- enough time has passed that you would rather not know where it has been.
There is no grace period. Anything holding the old value stops working immediately, so rotate when you have a minute to paste the new value wherever you use it.
4. Expire when you want none
Expire kills the token and leaves you without one. Use it when you are done with the tool entirely, or while you sort out a machine you no longer trust. You can create a new token whenever you like.
What a token can and cannot do
A token carries your access, not more than it:
- It sees the organizations you are an active member of, and nothing else.
- It loses an organization the moment your membership there is deactivated, or the organization itself is.
- It cannot change your password, read anyone else's tokens, or reach an organization you were never in.
It also does not survive you: deactivating your account takes the token with it.
Some things are yours to do in Hodoflow and cannot be done through an assistant at all:
- Nothing is deleted. No workflow, data model, field, dashboard, or widget can be removed, and a widget cannot be taken off a dashboard.
- Nothing is published or shared. Public dashboards and share links stay in Hodoflow.
- How long records are kept never changes, because shortening it deletes records.
- People, connections, and billing are untouched — no invitations, no role changes, no connection secrets.
- Service accounts can be created, but never read back. An assistant can make one so a webhook has something to authenticate callers with; its secret is shown once, here in Hodoflow, and an assistant never sees it. Only an owner or an admin can create one, and it can only be given the webhooks permission.
One thing to expect if an assistant builds you a dashboard: widgets belong to the workspace, not to a single dashboard. The same widget can sit on several, and editing it changes it everywhere it appears.
If you think it leaked
Rotate first, then work out what happened. Rotating takes a second and is complete — there is no second copy of the old value and nothing to clean up afterwards.
Common problems
"A valid personal access token is required." The tool is sending no token, a mistyped one, or one you have since rotated or expired. Create or rotate a token on your profile and paste the fresh value.
The token worked yesterday and does not today. Either it was rotated or expired — check your profile — or your membership in the organization you were reading was deactivated. Your organization's owner can confirm the second.
A tool asks for an organization. Assistants ask Hodoflow which organizations you belong to and pick from that list; you never paste an organization ID. If yours is missing, your membership there is not active.