Personal access token (PAT)
What it is
A personal access token is a credential representing a user or service account for an API, Git, or automation operation.
Why it exists
Some integrations need noninteractive access where an interactive sign-in is unsuitable. A PAT can be scoped and expired, but it is still a bearer credential that must be protected.
Key ideas
- Grant the smallest required scope, set an expiry, store it in an approved secret store, and rotate it.
- Do not use a PAT when a workflow token, GitHub App, service connection, managed identity, or OIDC federation is more appropriate.
- If a PAT leaks, revoke it immediately; deleting the visible source line does not make the credential safe.
Related
devops-platform-authentication · secretless-pipeline-authentication