> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chief.bot/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing API tokens securely

> Personal access tokens let integrations and scripts call the Chief API on your behalf, with your account's permissions.

Personal access tokens let [integrations](/help/integrations/integrations-overview) and scripts call the Chief API on your behalf, with your account's permissions. Treat a token like a password.

## Create a token

<Frame>
  <img src="https://mintcdn.com/chief-2d405d1a/6c2N7JENQEFQ6YbH/images/help/token-create.png?fit=max&auto=format&n=6c2N7JENQEFQ6YbH&q=85&s=fd24e541ee0e20ff7b212ef262a6ec9f" alt="Chief - the Create a personal access token form with the Name field" width="1080" height="480" data-path="images/help/token-create.png" />
</Frame>

1. Go to [**Settings → API tokens**](/help/integrations/api-access-personal-access-tokens).
2. Click **Create token**.
3. Enter a **Name** describing what it's for (up to 100 characters).
4. Choose an **Expiration**: **30 days**, **90 days**, **365 days**, or **Custom date**.
5. Click **Generate token**.
6. On the **Copy your token** screen, click **Copy**, paste the token into your secret store, then click **Done**.

<Warning>
  ⚠️ **Important:** This is the only time you'll see this token. Store it somewhere safe — once you close the dialog, Chief can't show the value again. If you lose it, revoke the token and create a new one.
</Warning>

## Expiration rules

<Frame>
  <img src="https://mintcdn.com/chief-2d405d1a/6c2N7JENQEFQ6YbH/images/help/token-expiry.png?fit=max&auto=format&n=6c2N7JENQEFQ6YbH&q=85&s=3cae1a4f0129bd3379cacb3ff3f85920" alt="Chief - the token Expiration field defaulting to 365 days with a one-year maximum" width="1080" height="300" data-path="images/help/token-expiry.png" />
</Frame>

Tokens default to **365 days**. If you pick a custom date, the server enforces a **one-year maximum**. Shorter-lived tokens are safer — prefer 30 or 90 days for automation you can rotate.

## Revoke a token

1. Go to **Settings → API tokens**.
2. Find the token in the list (you can see its **Created**, **Expires**, and **Last used** dates).
3. Click **Revoke**, then confirm **Revoke this token?**

The token stops working **immediately** and this can't be undone. A revoked token shows the status **Revoked**.

## Good habits

* Give each integration — including any [MCP server](/help/integrations/mcp-servers-connecting-custom-tools) — its own named token so you can revoke one without breaking the others.
* Never paste a token into chat, code committed to a repo, or a screenshot.
* Rotate tokens on a schedule and revoke any you no longer use.

## Frequently asked questions

<AccordionGroup>
  <Accordion title="I closed the dialog before copying my token. Can I see it again?">
    No — the token is shown only once. Revoke it and create a new one.
  </Accordion>

  <Accordion title="What happens to scripts using a token I revoke?">
    They stop working immediately. Revoking takes effect at once and can't be undone, so update your integration with a new token first if you need continuity.
  </Accordion>

  <Accordion title="Can I create a token that never expires?">
    No. The server enforces a one-year maximum, so the longest available is 365 days.
  </Accordion>

  <Accordion title="What can a token do?">
    A personal access token authenticates API requests with [your account's permissions](/help/security-privacy/authentication-account-security-magic-link-tokens) — it can do what your account can do. Give each integration its own token and the shortest practical expiration.
  </Accordion>
</AccordionGroup>