OAuth & API tokens

Phase 1 preview — pages render fixture data only; no changes are saved.
Preview only. Nothing is created, rotated, revoked or enforced from this screen, and no credential is generated. Secrets and token values are never shown.

Personal access tokens

Every token created by anyone, newest settings first as legacy lists them. The token value is shown to its owner once, when created, and never again.

NameOwnerClientStatusCreatedExpires
CI inventory syncAdmin User Personal Access ClientActive 2026-02-012041-02-01
  • Revoke
Grafana dashboardAlex Kim Personal Access ClientActive 2026-03-142041-03-14
  • Revoke
Old laptop scriptAlex Kim Personal Access ClientRevoked 2024-06-012039-06-01
  • Unrevoke
Contractor exportFormer Employee
deleted user
Personal Access ClientActive 2025-01-092040-01-09
  • Revoke
Short-lived testAdmin User Personal Access ClientExpired 2025-06-012026-09-01
  • Revoke
<img src=x onerror=alert(1)>Admin User Personal Access ClientActive 2026-06-062041-06-06
  • Revoke

Legacy tokens carry no scopes, no per-token expiry choice and no last-used date, so none is shown. Expiry is global (API_TOKEN_EXPIRY_YEARS in the environment). Revoking is reversible; people can also delete their own tokens.