Personal Access Tokens

A personal access token is a credential that acts as you: it carries your identity and role, and what it can do is what you can do in the application. You use one where a tool works as a person rather than as the organization, and it's the only credential calendar entries and agent connections accept.

Mint your token

Open your profile and go to the API Access tab. Any member can create their own token; no admin role is required. A user account holds only one live token.

You send it exactly like an API key, as a bearer token:

bash

curl https://your-abletime-host/api/public/v2/tasks \
  -H "Authorization: Bearer YOUR_PERSONAL_ACCESS_TOKEN"

What it reaches

A personal access token works on tasks, projects, users, and calendar entries; calendar entries accept nothing else, and only ever show you your own. The rest of the API takes an organization key instead. The full split is on Authentication.

Unlike an organization key, a personal token carries no grants. What a request may do is decided by your role and your project membership, exactly as it would be in the app. In other words, a PAT looks at your role's permissions, i.e. 'user' or 'admin', and that defines what is allowed. Because of this, all actions taken using the PAT are recorded as if the user performed it themselves, and the source of the change (i.e. 'api') is always recorded as well.

Agents and MCP

Agent connections authenticate as a person, so they run on your personal access token, and they require agent access to be enabled for the organization: an admin or owner switches on Agent access (MCP) under Settings → Integrations.

In an app you configure yourself, you supply the endpoint and your token. On a hosted browser platform, you add the endpoint and approve the connection on AbleTime's consent page; the platform then holds a connection of its own that acts as you.

Rotation is revocation

There is no separate revoke: to invalidate a token, rotate it from the same API Access tab, and the old token stops working immediately. An app configured with the token itself is cut off at once and needs the new token pasted in. A browser connection keeps working across rotation, because it follows whichever of your tokens is currently live; to sever one, remove the connector on the platform's side.

The credential model in full is on Authentication.