# Concept: API token

A **personal API token** lets a script — or an AI agent acting as you — call the app the way your signed-in browser does: same URLs, same authorization, sent as `Authorization: Bearer accoil_pat_…`. A token belongs to the **user**, not to one account, so it reaches every account you belong to, always capped by your role there; it never grants more than you could do yourself.

Tokens carry a **scope**: `read` (the default — can fetch anything you can see, change nothing; any write answers 403) or `write`. Minting and revoking tokens is itself a write, so a read token can never upgrade itself. The full value is shown exactly **once**, at creation — only a digest is stored, so afterwards a token is identified by name and last four characters. An optional expiry (30/90/365 days) limits the blast radius of a leak; revoking one stops it working immediately.

Related: [Account](/concepts/account) · [Member & roles](/concepts/member)