Personal Access Tokens
A personal access token (PAT) is a long-lived bearer token that is you. A request authenticated with your PAT sees exactly what you see and can do exactly what you can do — indistinguishable from you using the Portal, and audited as you.
This is the one credential whose API name and Portal name are the same: it appears to users as "Personal access token" ("Personlig tilgangstoken" in Norwegian), so you can use the term as-is when you talk to them (term reference). Unlike an App, a PAT is not scoped to one entity — it reaches everywhere you reach.
That power is the point, and the caveat:
Use PATs for your own scripts, notebooks, and servers. Never paste a PAT into a product or hosted service someone else runs (including a hosted AI assistant) — that hands them your full identity with nothing for you to constrain or attribute. For someone else's product or agent, use delegated access instead: it lets the product see what you see while its actions stay bounded by roles you consented to, and you can revoke it at any time.
Creating a token
Tokens are managed under your own profile — in the Portal under Profile → Access tokens, or via the API:
curl -X POST "https://api.lexabit.com/users/v1/me/tokens" \
-H "Authorization: Bearer $LEXABIT_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "name": "reporting-script" }'
The response contains the token's plaintext value once — store it
somewhere safe; it cannot be retrieved again. Listing your tokens
(GET /users/v1/me/tokens) never returns token values.
Lifecycle
| Operation | Endpoint |
|---|---|
| List your tokens (metadata only) | GET /users/v1/me/tokens |
| Create a token | POST /users/v1/me/tokens |
| Rename or extend a token | PATCH /users/v1/me/tokens/{tokenId} |
| Rotate (new value, same settings) | POST /users/v1/me/tokens/{tokenId}/rotate |
| Revoke a token | DELETE /users/v1/me/tokens/{tokenId} |
- Tokens expire: 90 days by default, one year at most. Expired tokens simply stop authenticating.
- You can hold at most 10 active tokens; revoke ones you no longer use.
- Rotation mints a fresh value and invalidates the old one — build your tooling to re-read the token from configuration so rotation is painless.
Using a token
Exactly like any other bearer token — with your own
X-Scope selection per request:
curl "https://api.lexabit.com/clients/v1" \
-H "Authorization: Bearer <your-pat>" \
-H "X-Scope: 42"
Because the token is you, there is nothing extra to grant: your roles, your visibility, and your scopes apply as-is.
Where to go next
- Delegated Access — the right choice for third-party products and hosted AI agents.
- Apps & API Keys — machine identities for your own servers and integrations.
- Access Concepts & Portal Terms — how each credential is named in the Portal.
- Bearer Tokens — short-lived session tokens from login.