# Personal access tokens

> Create the token that lets an AI assistant or a script act as you, and rotate or expire it when you need to.

A personal access token is how a tool acts as *you* outside the browser —
connecting an AI assistant to Hodoflow, or running a script from your own
machine. It reaches every organization you belong to and can do exactly what
you can do, no more.

That includes building. An assistant holding your token can create data models,
build and turn on workflows, and put dashboards together — the same work you do
in Hodoflow, in any organization you are a member of. Treat the value the way
you treat your password.

## Outcome

You have one token you can paste into a tool, and a one-click way to replace it
if it ever leaks.

## Before you start

Your token lives on your own profile, reached from the account menu. Nobody
else can see it — not your organization's owners, not support. If you lose the
value, no one can look it up for you.

If the thing that needs access is a *machine* rather than you — a webhook
sender, a scheduled script your team owns, an embedded dashboard — use a
[service account](/help/credentials-connections/service-accounts) instead. Those
belong to the organization and survive you leaving it.

## 1. Create your token

Open your profile, find **Personal access token**, and select **Create token**.
That is the whole step — there is nothing to name or configure, because you have
exactly one.

The value appears once. Copy it immediately and paste it into the tool that
needs it. Closing the page or reloading it is enough to lose the value forever;
if that happens, rotate and use the new one.

Tokens do not expire on a schedule. Yours keeps working until you rotate or
expire it, so nothing breaks at 3am because a date passed.

## 2. Use it

Most tools ask for a bearer token. For an AI assistant, see
[Connect an AI assistant](/developer/mcp) on the developer portal, which has the exact
command for Claude and the list of what an assistant can do.

## 3. Rotate when you want a new value

**Rotate** issues a new token and kills the old value in the same moment. Use it
when:

- you pasted the token somewhere public;
- a machine that held it was lost, sold, or handed on; or
- enough time has passed that you would rather not know where it has been.

There is no grace period. Anything holding the old value stops working
immediately, so rotate when you have a minute to paste the new value wherever
you use it.

## 4. Expire when you want none

**Expire** kills the token and leaves you without one. Use it when you are done
with the tool entirely, or while you sort out a machine you no longer trust.
You can create a new token whenever you like.

## What a token can and cannot do

A token carries your access, not more than it:

- It sees the organizations you are an active member of, and nothing else.
- It loses an organization the moment your membership there is deactivated, or
  the organization itself is.
- It cannot change your password, read anyone else's tokens, or reach an
  organization you were never in.

It also does not survive you: deactivating your account takes the token with it.

Some things are yours to do in Hodoflow and cannot be done through an assistant
at all:

- **Nothing is deleted.** No workflow, data model, field, dashboard, or widget
  can be removed, and a widget cannot be taken off a dashboard.
- **Nothing is published or shared.** Public dashboards and share links stay in
  Hodoflow.
- **How long records are kept never changes**, because shortening it deletes
  records.
- **People, connections, and billing** are untouched — no invitations, no role
  changes, no connection secrets.
- **Service accounts can be created, but never read back.** An assistant can
  make one so a webhook has something to authenticate callers with; its secret
  is shown once, here in Hodoflow, and an assistant never sees it. Only an owner
  or an admin can create one, and it can only be given the webhooks permission.

One thing to expect if an assistant builds you a dashboard: widgets belong to
the workspace, not to a single dashboard. The same widget can sit on several,
and editing it changes it everywhere it appears.

## If you think it leaked

Rotate first, then work out what happened. Rotating takes a second and is
complete — there is no second copy of the old value and nothing to clean up
afterwards.

## Common problems

**"A valid personal access token is required."** The tool is sending no token,
a mistyped one, or one you have since rotated or expired. Create or rotate a
token on your profile and paste the fresh value.

**The token worked yesterday and does not today.** Either it was rotated or
expired — check your profile — or your membership in the organization you were
reading was deactivated. Your organization's owner can confirm the second.

**A tool asks for an organization.** Assistants ask Hodoflow which
organizations you belong to and pick from that list; you never paste an
organization ID. If yours is missing, your membership there is not active.