# Access tokens

Manage tokens in **Settings > Access tokens**. Token creation must be enabled
for your organization.

## Personal access tokens

Personal access tokens act on your behalf for a limited time. Their grants
limit which repositories and VMs they can access, and at what level.

Use the [avr CLI](/cli/) to create a token. Sign in, then replace `my-org` and
`owner/repo` with your organization slug and repository:

```sh
avr auth login
avr token create --org my-org --name ci-reader --repo owner/repo --ttl 8h
avr token create --help
```

The console lists your live tokens. Eligible organization administrators can
also see and revoke other members' tokens. Revoking a token stops new requests;
credentials it already obtained, such as a Git token or VM password, remain
valid until they expire or are rotated.

## Service tokens

Service tokens belong to a group rather than a person. Use them for automation
that reads repository information, SBOMs or firewall rules. They continue
working when their creator leaves the organization.

Administrators with token-management permission can create a service token in
**Settings > Access tokens**:

1. Choose a name and an owning group.
2. Add repositories or firewall rules to its read access. You can select
   individual repositories, individual firewall rules, or all firewall rules.
   You can only grant access that you hold yourself.
3. Choose a secret lifetime, then create the token.
4. Copy the secret and store it securely. It is shown only once.

**Never expires:** This secret does not expire. Anyone with it can use its
allowed access. Revoke it if exposed.

Suspending the owning group stops the token's access. The group cannot be
deleted until its tokens are revoked or expired.

### Change access

Choose **Edit access** to add or remove grants. Changes apply on the next
request. If service-token creation or resource access is disabled, you can
still remove access and revoke existing tokens.

### Rotate a secret

Choose **Rotate** to replace a lost secret or update your automation's
credentials. Select a lifetime for the new secret and an overlap period for
the current secret. The current secret works during that overlap, but never
past its own expiry or the new secret's. Update your automation before the
overlap ends.

Rotating again during an overlap immediately stops the oldest secret. The
console warns before you do this.

### Revoke tokens

Choose **Revoke** to stop a token and its overlapping secrets. For a suspected
leak affecting several tokens, open the **⋯** menu of the service token
list, choose **Revoke all service tokens** and confirm with your
organization's slug. Revocation cannot be undone.