Personal Access Tokens

Personal Access Tokens (PATs) are the simplest way to authenticate programmatic API access. They carry the full permissions of your account and are not subject to CSRF requirements.

PATs are prefixed hzel_ and stored by SHA-256 hash — the raw value is shown once at creation and never stored in plaintext.

Pass a PAT in the Authorization header for any API call:

Authorization: Bearer hzel_AbCdEfGhIjKlMnOpQrStUvWxYz012345678

No x-csrf-token is required when using PAT auth.

`POST /api/v1/tokens`

Create a new PAT. Not accessible via OAuth application tokens.

Header	Value	Required
`Authorization`	`Bearer <token>`	Yes
`Content-Type`	`application/json`	Yes

Request Body

Field	Type	Required	Description
`name`	string	Yes	Human-readable label for the token
`expires_at`	string (ISO 8601)	No	Expiry date; omit for a non-expiring token

Success 200

{
  "data": {
    "token": "hzel_AbCdEfGhIjKlMnOpQrStUvWxYz012345678",
    "id": "01942cf7-…",
    "name": "CI deploy key",
    "prefix": "hzel_AbCdEfGh",
    "created_at": "2026-03-28T00:00:00Z",
    "expires_at": "2027-01-01T00:00:00Z",
    "last_used_at": null,
    "revoked_at": null
  }
}

Copy the token value now — it will not be shown again.

Errors

Status	`error.code`	Reason
`401`	`UNAUTHORIZED`	Missing or invalid auth
`403`	`FORBIDDEN`	OAuth app tokens may not create PATs

`GET /api/v1/tokens`

List all non-revoked tokens for your account. The raw token value is never returned — only the display prefix.

Header	Value	Required
`Authorization`	`Bearer <token>`	Yes

Success 200

{
  "data": [
    {
      "id": "01942cf7-…",
      "name": "CI deploy key",
      "prefix": "hzel_AbCdEfGh",
      "created_at": "2026-03-28T00:00:00Z",
      "expires_at": "2027-01-01T00:00:00Z",
      "last_used_at": "2026-03-28T09:00:00Z",
      "revoked_at": null
    }
  ]
}

Errors

Status	`error.code`	Reason
`401`	`UNAUTHORIZED`	Missing or invalid auth

`DELETE /api/v1/tokens/{id}`

Revoke a PAT by ID. Revoked tokens are rejected immediately on next use.

Header	Value	Required
`Authorization`	`Bearer <token>`	Yes

Success 200

{ "data": "revoked" }

Errors

Status	`error.code`	Reason
`401`	`UNAUTHORIZED`	Missing or invalid auth
`404`	`NOT_FOUND`	Token ID not found