> For the complete documentation index, see [llms.txt](https://docs.podigee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.podigee.com/documentation/start-here/ai-agents/connect-and-authorize/create-and-use-a-personal-access-token.md).

# Create and use a personal access token

Create a scoped Podigee MCP token for a CLI, agent, or automation that cannot use browser authorization.

Create a named Model Context Protocol (MCP) personal access token for a protected client that cannot complete browser OAuth.

## Before you start

* Prefer browser authorization for an interactive compatible MCP client or `pdg` connection.
* Confirm that your Podigee account has access to **My account > API**.
* Decide which Podigee account and permissions the automation needs.
* Prepare protected secret storage. The token is shown once.

## Create the token

1. Open **My account** in Podigee.
2. Select **API**.
3. Find **Personal access tokens**.
4. Select **Create MCP token**.
5. Enter a name that identifies the client or automation.
6. Select the Podigee account.
7. Select only the required MCP permissions.
8. Create the token.
9. Copy the token into protected secret storage.
10. Close the dialog after the secret is stored.

The token starts with `pdg_pat_`. Podigee cannot show the complete token again.

## Use the token with pdg

Use hidden terminal input:

```sh
pdg auth login --api-key
```

You can also use `pdg auth token`, which reads the token from a hidden prompt. For unattended automation, send the secret through standard input to `pdg auth token --stdin` from your secret manager. Do not put the token in a command argument or shell history.

## Use the token with an MCP client

Send the token as a bearer token to `https://mcp.podigee.com/mcp`. The client sends this HTTP header with each request:

```
Authorization: Bearer pdg_pat_your_token
```

Codex reads the token from an environment variable:

```sh
export PODIGEE_TOKEN=pdg_pat_your_token
codex mcp add podigee --url https://mcp.podigee.com/mcp --bearer-token-env-var PODIGEE_TOKEN
```

Claude Code reads the token from a stored header:

```sh
claude mcp add --transport http podigee https://mcp.podigee.com/mcp \
  --header "Authorization: Bearer pdg_pat_your_token"
```

Prefer an environment variable or a secret manager over a stored header. A stored header keeps the secret in a client configuration file.

Restart the client after you set the secret.

## Expected result

The client validates the token against the Podigee MCP resource and records the selected account. `pdg me --json` returns the same account and a scope list no broader than the permissions that you selected.

## Rotate the token

MCP personal access tokens expire after 90 days. Podigee sends expiry reminders 14 days and 3 days before expiry.

1. Create a replacement with the same or narrower permissions.
2. Update the protected secret used by the client.
3. Verify one real read-only request with the replacement.
4. Remove the old token.

Browser-based OAuth connections use rotating refresh tokens and do not use this 90-day PAT cycle.

## If the token does not work

Confirm that you created an MCP token, not a legacy REST API token. Confirm the selected account, expiry, subscription, and scopes. A legacy API key or legacy `read` or `read_write` token cannot authorize the MCP server.

If the token may have been exposed, remove it immediately and create a replacement.

## Next step

[Choose permissions and scopes](/documentation/start-here/ai-agents/connect-and-authorize/choose-permissions-and-scopes.md) for the smallest useful token.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.podigee.com/documentation/start-here/ai-agents/connect-and-authorize/create-and-use-a-personal-access-token.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.