Personal Access Tokens

A personal access token (PAT) is a long-lived bearer token that is you. A request authenticated with your PAT sees exactly what you see and can do exactly what you can do — indistinguishable from you using the Portal, and audited as you.

This is the one credential whose API name and Portal name are the same: it appears to users as "Personal access token" ("Personlig tilgangstoken" in Norwegian), so you can use the term as-is when you talk to them (term reference). Unlike an App, a PAT is not scoped to one entity — it reaches everywhere you reach.

That power is the point, and the caveat:

A PAT is your identity — only use it in tooling you operate

Use PATs for your own scripts, notebooks, and servers. Never paste a PAT into a product or hosted service someone else runs (including a hosted AI assistant) — that hands them your full identity with nothing for you to constrain or attribute. For someone else's product or agent, use delegated access instead: it lets the product see what you see while its actions stay bounded by roles you consented to, and you can revoke it at any time.

Creating a token

Tokens are managed under your own profile — in the Portal under Profile → Access tokens, or via the API:

curl -X POST "https://api.lexabit.com/users/v1/me/tokens" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "reporting-script" }'

The response contains the token's plaintext value once — store it somewhere safe; it cannot be retrieved again. Listing your tokens (GET /users/v1/me/tokens) never returns token values.

Lifecycle

Operation	Endpoint
List your tokens (metadata only)	GET /users/v1/me/tokens
Create a token	POST /users/v1/me/tokens
Rename or extend a token	PATCH /users/v1/me/tokens/{tokenId}
Rotate (new value, same settings)	POST /users/v1/me/tokens/{tokenId}/rotate
Revoke a token	DELETE /users/v1/me/tokens/{tokenId}

• Tokens expire: 90 days by default, one year at most. Expired tokens simply stop authenticating.
• You can hold at most 10 active tokens; revoke ones you no longer use.
• Rotation mints a fresh value and invalidates the old one — build your tooling to re-read the token from configuration so rotation is painless.

Using a token

Exactly like any other bearer token — with your own X-Scope selection per request:

curl "https://api.lexabit.com/clients/v1" \
  -H "Authorization: Bearer <your-pat>" \
  -H "X-Scope: 42"

Because the token is you, there is nothing extra to grant: your roles, your visibility, and your scopes apply as-is.

Where to go next

• Delegated Access — the right choice for third-party products and hosted AI agents.
• Apps & API Keys — machine identities for your own servers and integrations.
• Access Concepts & Portal Terms — how each credential is named in the Portal.
• Bearer Tokens — short-lived session tokens from login.