Create and use access tokens

This page shows how to create and use a personal access token (PAT). A token authenticates as you and works everywhere the CLI and SDK do, without a browser.

Create a token

acc pat create --name ci-runner

The token is printed once. Copy it now; it cannot be shown again. If you omit --name, the CLI asks for one.

Create one token per machine or pipeline, named after where it runs, so you can revoke each one on its own.

Use a token

CLI, CI, and agents

export AF_TOKEN="..."        # the token you copied
export AF_PROJECT_ID="..."   # from acc projects list

acc whoami --json            # confirms the identity and project
acc services list

With both variables set, every command runs without prompts. Add -y to commands that ask for confirmation.

SDK

import { AlternateFuturesSdk, PersonalAccessTokenService } from '@alternatefutures/sdk';

const af = new AlternateFuturesSdk({
  accessTokenService: new PersonalAccessTokenService({
    personalAccessToken: process.env.AF_TOKEN,
    projectId: process.env.AF_PROJECT_ID,
  }),
});

List and revoke tokens

acc pat list                 # names, ids, and expiry dates
acc pat delete <tokenId>     # revoke one

Revoke a token immediately if it may have leaked, then create a new one.

Keep tokens safe

• Store tokens in a secrets manager or your CI's secret store, never in source control.
• Give each pipeline its own token and rotate them periodically.
• The CLI keeps your own login in ~/.alternate-futures/ with owner-only permissions; acc logout clears it.

Next steps

• Manage projects
• Docs for AI agents
• Sign in and accounts