Access Tokens
Personal access tokens let you authenticate with the Runner API without using your password. They are intended for automated use — CI pipelines, scripts, local development tooling — where interactive login is not possible. Each token is scoped to limit what it can do and expires automatically on a date you choose.
Tokens are scoped primarily to project-level resources, plus a handful of account-wide reads: your own account details, basic information about other users, instance-wide search, and usage statistics — and, if you're an Admin, executor management. Even a Full Access token can never modify your profile or account credentials, and can only list or view — never create or revoke — tokens and connected applications; those actions always require signing in.
If the consumer supports it, consider connecting it via OAuth instead — it avoids handling a raw secret and can be revoked the same way.
Your tokens
Open Integrations from the left sidebar (or search for it) and find the Personal Access Tokens card. The list shows all your active tokens with their description, scope, expiry date, and when each was last used. A short prefix is shown below the description to help identify which token is which without revealing the full secret.
Click a token to open its detail view, showing when it was created, when it was last used and from which IP address, and its total request count.
Creating a token
Click Add Access Token on the Integrations page. Fill in the following fields:
Description — a short label identifying where the token will be used, for example CI pipeline or local dev. This is only for your reference.
Scope — controls what operations the token permits:
- Full Access — read and write access to everything the token can reach.
- Read Only — read-only access to the same resources. Use this when the consumer only needs to fetch data.
Expires At — the date on which the token stops working. The token becomes invalid on this date. The earliest allowed expiry is tomorrow; the form defaults to one month from today.
After clicking Create, Runner shows the full token value exactly once in a dialog. Copy it immediately and store it somewhere safe — it cannot be retrieved again. Closing the dialog without copying means you will need to delete the token and create a new one.
Using a token
Pass the token in the Authorization header using the ApiKey scheme:
Authorization: ApiKey <your-token>See the API Reference for available endpoints.
Revoking a token
Click the delete button on a token row, either in the list or in its detail view. Revocation takes effect immediately — any request using that token will be rejected from that point on. Deleted tokens cannot be restored.
Tokens are also automatically revoked when your account is deleted.
Email notifications
If SMTP is configured in Settings, Runner sends you an email whenever a token is created or deleted on your account. Seven days before a token expires, you receive a reminder to rotate it. When the expiry date arrives and the token is deleted, you receive a final notification. These emails serve as security notices — if you receive one you did not initiate, revoke the token immediately and contact your Admin.