Personal access tokens
An API key is a workspace service account. A personal access token is you: it carries your identity and acts with your permissions across every workspace you belong to. It's what the MCP server and command-line tooling use.
A token looks like:
zw_pat_live_abc12345_…
How it differs from an API key
| API key | Personal access token | |
|---|---|---|
| Identity | A workspace service account | You |
| Reach | One workspace (intrinsic to the key) | Every workspace you're a member of |
| Permissions | The key's scopes | Your scopes, capped by your role in each workspace |
| Audit trail | Attributed to the workspace | Attributed to you |
| Typical use | CI, production services | The MCP server, CLI, your own scripts |
Minting one
Create a token at accounts.zerowidth.ai → Integrations. You choose:
ScopesrequiredWhat the token can do — the same scope catalog as API keys. A token can never exceed your own permissions in a workspace, whatever its scopes say.
ExpiryrequiredTokens always expire — pick 30, 60, 90 (default), or up to 365 days. Forced rotation is a leak mitigation; there's no never-expires option.
Default workspaceoptionalA workspace to act in when a call doesn't name one. Without a default, calls that need a workspace must pass one explicitly (or you'll get workspace_required).
IP allowlistoptionalRestrict the token to specific networks (CIDR ranges). Recommended for service hosts; skip it for a laptop on changing networks.
Copy the token when it's shown — it's displayed exactly once. Revoke it anytime from the same page; revocation takes effect on the next call.