---
title: "Create a personal access token for AI agents"
description: "Create a personal access token and store it safely, scope it with a permission level and data source range, then change that scope or revoke the token later"
canonical_url: "https://docs.ardge.com/en/knowledge/precisemd/access-tokens"
---
# Create a personal access token for AI agents

> Create a personal access token and store it safely, scope it with a permission level and data source range, then change that scope or revoke the token later

## Overview

A personal access token is a long-lived credential that lets an AI agent call the PreciseMD API as a particular user. Access over MCP or the CLI authenticates with this token.

Every token carries two layers of scope: **Permissions** decides what kind of operations it can perform, and **Data source scope** decides which storage connections it can reach. This article covers creating a token, scoping it, changing that scope later, and revoking it if it leaks.

## What you'll learn

- Create a personal access token and store it safely
- Pick the right permission level and data source scope for the job
- Check a token's last use and expiry status
- Change an existing token's scope, or revoke it

**Estimated time: about 10 minutes**

## Applies to

- PreciseMD 1.4.0 and later

## Before you begin

- The storage connections you want to authorize already exist. They have to, if you plan to pick data sources individually
- You are a PreciseMD administrator

<warning>

**Members can't create their own tokens:**

Personal access tokens live on the **User management** page, and members don't see the administrator interface. An administrator has to create a member's token and hand it over.

</warning>

## Step 1: Open that user's token list

1. Go to the **User management** page
2. On the row of the user you're creating a token for, click the key icon, **Manage personal access tokens**

The **Personal access tokens** dialog shows "User: <username>

" and lists that user's existing tokens. With none yet, it shows "This user has no personal access tokens".

</username>



![The User Management page](https://docs.ardge.com/screenshots/knowledge/en/precisemd/access-tokens/step-1-1.webp)

![The Personal Access Tokens dialog](https://docs.ardge.com/screenshots/knowledge/en/precisemd/access-tokens/step-1-2.webp)

## Step 2: Create the token

1. Click **Create** at the top of the dialog
2. Fill in the fields as follows

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Value
    </th>
    
    <th>
      Rules and notes
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Name
      </strong>
    </td>
    
    <td>
      A name that identifies this token
    </td>
    
    <td>
      Required, 1–100 characters. Name the purpose and the device — for example <code>
        Claude Desktop on MacBook
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Permissions
      </strong>
    </td>
    
    <td>
      One of three levels
    </td>
    
    <td>
      See "Permission levels" below
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Data source scope
      </strong>
    </td>
    
    <td>
      Turn on <strong>
        Authorize all data sources
      </strong>
      
      , or select them individually
    </td>
    
    <td>
      You can't submit with neither set
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Expires
      </strong>
    </td>
    
    <td>
      The date the token stops working
    </td>
    
    <td>
      Optional, any date after today. Left empty, it never expires
    </td>
  </tr>
</tbody>
</table>

1. Click **Save**

<warning>

**The full token is shown only once:**

After creation the page shows **Personal access token created** with the note "Copy it now — the full token can't be retrieved once you close this dialog." Click the copy icon and store it, then click **I've stored it safely**. If you don't, your only option is to revoke the token and create another.

</warning>

### Permission levels

<table>
<thead>
  <tr>
    <th>
      Level
    </th>
    
    <th>
      What it can do
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Read only
      </strong>
    </td>
    
    <td>
      Read data only — it can't create or modify anything
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Read and write, no delete
      </strong>
    </td>
    
    <td>
      Create and modify — adding tasks, triggering runs — but not delete or cancel
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Read, write, and delete
      </strong>
    </td>
    
    <td>
      Everything above, plus deleting resources and canceling running tasks
    </td>
  </tr>
</tbody>
</table>

<tip>

**Give the least permission the job needs:**

An agent that only extracts content gets **Read only**; one that needs to create tasks gets **Read and write, no delete**. Use **Read, write, and delete** only when the agent genuinely needs to delete resources.

</tip>

### Data source scope

- **Authorize all data sources** on — the token reaches every storage connection, including ones added later
- **Authorize all data sources** off — select the connections to authorize in the dropdown. The button then reads "N data sources selected"

Submit with neither set and the field shows "Select at least one data source, or turn on authorize all".

![The form for creating a token](https://docs.ardge.com/screenshots/knowledge/en/precisemd/access-tokens/step-2-1.webp)

![A name and datasource scope filled in](https://docs.ardge.com/screenshots/knowledge/en/precisemd/access-tokens/step-2-2.webp)

## Step 3: Check a token's status

Back in the **Personal access tokens** dialog, each token shows its name and expiry status: **Never expires**, **Expires on **, **Expired on **, or **Revoked on **.

Click **Details** on a row for the full picture:

<table>
<thead>
  <tr>
    <th>
      Item
    </th>
    
    <th>
      What it shows
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Name
      </strong>
    </td>
    
    <td>
      The name given at creation
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Token
      </strong>
    </td>
    
    <td>
      The masked token string, to tell which one it is
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Created
      </strong>
    </td>
    
    <td>
      When the token was created
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Last used
      </strong>
    </td>
    
    <td>
      The most recent API call made with this token
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Expires
      </strong>
    </td>
    
    <td>
      The expiry date, or <strong>
        Never expires
      </strong>
    </td>
  </tr>
</tbody>
</table>

For an expired or revoked token, the **Details** button is disabled.

![Token details](https://docs.ardge.com/screenshots/knowledge/en/precisemd/access-tokens/step-3.webp)

## Step 4: Change or revoke a token

To change an existing token's scope:

1. Click **Details** on that row in the **Personal access tokens** dialog
2. Adjust **Permissions** or **Data source scope**
3. Click **Save**

The page shows "Permission scope updated". **Name** and **Expires** can't be changed after creation.

To revoke a token:

1. Click **Revoke** on that row in the **Personal access tokens** dialog
2. Click **Revoke** again in the confirmation dialog

<warning>

**Revoking can't be undone:**

Calls using this token fail immediately after revocation. That agent needs a newly created token.

</warning>

The page shows "Revoked "<name>

"", and the row is marked **Revoked on **.

</name>



## Related articles

- [Schedule an OCR task to process a folder automatically](https://docs.ardge.com/en/knowledge/precisemd/schedule-ocr-tasks)
- [Operate PreciseMD through the built-in agent](https://docs.ardge.com/en/knowledge/precisemd/built-in-agent)


## Sitemap

See the full [sitemap](https://docs.ardge.com/sitemap.md) for all pages.