# Create and use access tokens (/guides/api-keys)



This page shows how to create and use a personal access token (PAT). A token
authenticates as you and works everywhere the CLI and SDK do, without a
browser.

## Create a token [#create-a-token]

```bash
acc pat create --name ci-runner
```

The token is printed once. Copy it now; it cannot be shown again. If you omit
`--name`, the CLI asks for one.

Create one token per machine or pipeline, named after where it runs, so you
can revoke each one on its own.

## Use a token [#use-a-token]

### CLI, CI, and agents [#cli-ci-and-agents]

```bash
export AF_TOKEN="..."        # the token you copied
export AF_PROJECT_ID="..."   # from acc projects list

acc whoami --json            # confirms the identity and project
acc services list
```

With both variables set, every command runs without prompts. Add `-y` to
commands that ask for confirmation.

### SDK [#sdk]

```typescript
import { AlternateFuturesSdk, PersonalAccessTokenService } from '@alternatefutures/sdk';

const af = new AlternateFuturesSdk({
  accessTokenService: new PersonalAccessTokenService({
    personalAccessToken: process.env.AF_TOKEN,
    projectId: process.env.AF_PROJECT_ID,
  }),
});
```

## List and revoke tokens [#list-and-revoke-tokens]

```bash
acc pat list                 # names, ids, and expiry dates
acc pat delete <tokenId>     # revoke one
```

Revoke a token immediately if it may have leaked, then create a new one.

<Callout type="info">
  Token management in the web app is not available yet. Use the commands above.
</Callout>

## Keep tokens safe [#keep-tokens-safe]

* Store tokens in a secrets manager or your CI's secret store, never in source
  control.
* Give each pipeline its own token and rotate them periodically.
* The CLI keeps your own login in `~/.alternate-futures/` with owner-only
  permissions; `acc logout` clears it.

## Next steps [#next-steps]

* [Manage projects](/guides/projects)
* [Docs for AI agents](/ai-agents)
* [Sign in and accounts](/guides/authentication)