Personal Access Tokens
Replace the one organization key your whole team shares with API tokens that name their owner, carry only the permissions they need, and always expire.
Your whole team shares one organization API key. It can call the entire API, nobody can tell who made which call, and it keeps working after the person who created it leaves.
Personal access tokens fix that. Each one belongs to a single admin in a single organization, names its owner, and carries only the permissions you pick.
- Scoped — pick exactly which resources the token can read or change; nothing is granted by default
- Stops when access stops — a token stops working when its owner loses admin, leaves the organization, or is deprovisioned through SCIM
- Always expires — 7, 30, 60 or 90 days, or any date up to one year
- Works with the REST API and remote MCP — send it as a bearer token; over MCP, your agent only sees the tools its permissions allow
- Easy to spot — every token starts with
crnts_pat_, so a leaked one stands out in a log or a diff - Shown once — copy it at creation; Currents stores only a hash
Create tokens under Account → Personal Access Tokens. Admins can review and revoke every token in their organization from Organization → API & Record Keys.
Existing organization API keys keep working.