---
title: "Create a personal access token for the CLI and automation"
description: "Create a personal access token on the Token management page, choose its permission level and data source scope, and store the plaintext safely"
canonical_url: "https://docs.ardge.com/en/knowledge/scribestt/access-tokens"
---
# Create a personal access token for the CLI and automation

> Create a personal access token on the Token management page, choose its permission level and data source scope, and store the plaintext safely

## Overview

The CLI and your own automation can't reuse the web interface's sign-in state — they authenticate with a personal access token (PAT) instead. A token is a long-lived credential you scope with a permission level, a set of accessible data sources, and an expiry.

This article covers creating a token on the **Token management** page, choosing the right scope, and storing and deleting the token.

## What you'll learn

- Create a personal access token and assign its owner
- Choose the permission level and data source scope for the job
- Store the token plaintext, and delete it when you no longer need it

**Estimated time: about 5 minutes**

## Applies to

- ARX OS 1.0 and later
- ScribeSTT 1.3.0 and later

## Before you begin

- You are signed in to ScribeSTT as an administrator. **Token management** sits in the **Administrator** group in the left navigation, and members don't see the page
- To limit a token to specific data sources, those data sources have to exist already. With none in the system, you can only authorize the full scope

## Step 1: Open the create token dialog

1. In the **Administrator** group in the left navigation, go to the **Token management** page
2. Click **New** at the top right

The **Create personal access token** dialog opens.

## Step 2: Fill in the token settings

Fill in the fields as follows:

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Value
    </th>
    
    <th>
      Rules and notes
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Name
      </strong>
    </td>
    
    <td>
      What this token is for
    </td>
    
    <td>
      Required, up to 100 characters. Name the user and the location — for example "Claude Desktop on MacBook"
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Owner
      </strong>
    </td>
    
    <td>
      The account this token acts as
    </td>
    
    <td>
      Required, picked from existing accounts. Everything the token does is recorded under that account
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Data source scope
      </strong>
    </td>
    
    <td>
      The data sources this token can reach
    </td>
    
    <td>
      Required. <strong>
        All data sources
      </strong>
      
       is selected by default
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Permissions
      </strong>
    </td>
    
    <td>
      The kind of operations this token can perform
    </td>
    
    <td>
      Required, one of three. <strong>
        Read only
      </strong>
      
       by default
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Expires
      </strong>
    </td>
    
    <td>
      The token's lifetime
    </td>
    
    <td>
      <strong>
        Never expires
      </strong>
      
      , <strong>
        30 days
      </strong>
      
      , <strong>
        90 days
      </strong>
      
      , or <strong>
        365 days
      </strong>
      
      . <strong>
        Never expires
      </strong>
      
       by default
    </td>
  </tr>
</tbody>
</table>

### The three permission levels

<table>
<thead>
  <tr>
    <th>
      Level
    </th>
    
    <th>
      What it can do
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Read only
      </strong>
    </td>
    
    <td>
      Queries only: listing and viewing transcriptions, tasks, runs, data sources, and glossaries
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Read and write, no delete
      </strong>
    </td>
    
    <td>
      Queries, plus creating, updating, canceling, retrying, and triggering tasks
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Read, write, and delete
      </strong>
    </td>
    
    <td>
      All of the above, plus deleting
    </td>
  </tr>
</tbody>
</table>

<warning>

**The three levels are independent — they don't inherit:**

Choosing **Read, write, and delete** does not automatically satisfy a **Read only** check. Pick the single level that matches what the token actually needs to do, rather than always picking the broadest.

</warning>

### Data source scope

Leaving **All data sources** selected means this token can reach every data source, including ones added later.

Clear it and a data source list appears — select the ones to authorize. With none selected, submitting shows "Select at least one data source".

With no data sources in the system yet, **All data sources** is disabled and shows "There are no data sources yet, so only the full scope can be authorized. Create a data source first to scope individual ones."

<warning>

**A batch task needs both its source and target in scope:**

For a token to operate a batch task, both that task's source data source and its target data source have to be in the authorized scope. Authorize only one end and the task is invisible to that token.

</warning>

## Step 3: Store the token plaintext

1. Click **Create**
2. In the **"" created** dialog, click the copy icon and put the token into your password manager or deployment configuration
3. Click **I've stored it**

<warning>

**The plaintext is shown only once:**

Once the dialog closes, the plaintext can't be retrieved. The dialog won't close on Esc or an outside click — **I've stored it** is the only way out. Close it without storing and your only option is to delete the token and create another.

</warning>

The plaintext starts with `arxstt_pat_`. Closing the dialog returns you to the **Token management** list, where the new token appears.

## Reviewing and deleting tokens

The **Token management** list has these columns:

<table>
<thead>
  <tr>
    <th>
      Column
    </th>
    
    <th>
      What it shows
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Name
      </strong>
    </td>
    
    <td>
      The name given at creation
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Owner
      </strong>
    </td>
    
    <td>
      The account the token belongs to
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Permissions
      </strong>
    </td>
    
    <td>
      <strong>
        Read only
      </strong>
      
      , <strong>
        Read and write, no delete
      </strong>
      
      , or <strong>
        Read, write, and delete
      </strong>
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Data source scope
      </strong>
    </td>
    
    <td>
      <strong>
        All data sources
      </strong>
      
      , or how many are authorized
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Status
      </strong>
    </td>
    
    <td>
      <strong>
        Valid
      </strong>
      
       or <strong>
        Expired
      </strong>
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Expires
      </strong>
    </td>
    
    <td>
      The expiry date and time, or <strong>
        Never expires
      </strong>
      
       when unset
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Actions
      </strong>
    </td>
    
    <td>
      Delete
    </td>
  </tr>
</tbody>
</table>

Click the delete icon on a row and confirm, and the token stops working immediately. Deletion can't be undone — any CLI or automation using that token needs a new one.

## Related articles

- [Connect a NAS data source and create a batch transcription task](https://docs.ardge.com/en/knowledge/scribestt/nas-batch-transcription)


## Sitemap

See the full [sitemap](https://docs.ardge.com/sitemap.md) for all pages.