# Personal access tokens

`/settings/tokens` lists and issues tokens for the API, git over HTTPS and
automation. Tokens start with `gct_`; the list only ever shows the last eight
characters.

## View your tokens

Each token shows its name, last eight characters, expiry, and the permissions
it carries in plain words, one line per grant, for example
`Read & write code on all repositories`. Revoked tokens are badged
**Revoked** and keep their history. Click a token to open its detail: creation,
expiry and revocation dates, the actor it acts as, who delegated it (if anyone)
and the full permission list. Long lists page with **Load more**.

## Create a token

**Generate new token** opens a form:

- **Name**: a label for your own reference.
- **Expiration**: 30, 60 or 90 days, or 1 year. Every token expires.
- **Permissions**: one or more grants. Each grant picks a **Target**
  (Repositories, Branches, Pull requests, Issues, Comments, Organizations,
  Teams, Tokens, Personal profile), a **Scope** (everything of that kind; branches and pull
  requests can instead be narrowed to a branch pattern such as `release/*`),
  and a level per permission family: **No access**, **Read**, **Read & write**
  or **Full admin**, limited to what that family allows. A preview under each
  grant reads back exactly what it will allow. **Add another grant** stacks
  more; the bin removes one.

The secret is shown once, in a **Token created** dialog with a copy button.
Close it and the secret is gone; issue or rotate to get a new one.

## Rotate or revoke a token

**Rotate** issues a replacement secret with the same name, permissions and
expiry, revokes the old one, and shows the new secret once. **Revoke** ends
the token immediately. Neither can be undone.

## Confirmation

Issuing, rotating and revoking need a recent confirmation of your identity.
If your session's confirmation window has lapsed a **Confirm it's you** dialog
appears; confirm with a passkey or password and the action completes on its
own. See [account settings](https://git.cafe/docs/account/account-settings.md#confirming-its-you).