> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nimt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Personal access tokens

> Connect a client that accepts an Authorization header.

A personal access token (PAT) is a secret credential tied to your Nimt user and
one workspace. Use it when your client supports bearer tokens but cannot complete
OAuth, or when you need a non-interactive connection.

<Warning>
  PAT settings may not be available to your account during pre-release. Follow
  these steps only once Nimt has confirmed access. Contact
  [support@nimt.ai](mailto:support@nimt.ai) if the settings entry is missing.
</Warning>

## Create a token

<Steps>
  <Step title="Choose the workspace">
    Sign in to Nimt and switch to the workspace you want to connect. The token
    stays tied to this workspace even if you switch workspaces later.
  </Step>

  <Step title="Open Personal access tokens">
    Go to **Settings → Personal access tokens**. Give the token a recognizable
    name, such as `Codex laptop`, and choose **Expires after**. The current
    options are 30, 90, 180, or 365 days; the default is 90 days.
  </Step>

  <Step title="Create and save">
    Choose **Create token**, then **Copy token**. The complete token is shown
    only once and begins with `nimt_pat_`. Store it in a password manager or
    your client's secure credential store. Nimt stores its hash, so a lost token
    must be replaced.
  </Step>
</Steps>

New tokens include both `mcp:read` and `mcp:write`. There is currently no scope
selector. Read the [permission rules](/mcp/authentication/overview#permissions)
before granting a client access.

## Supply the credential

Configure the client's remote MCP connection to send this header to
`https://api.nimt.ai/mcp`:

```http theme={null}
Authorization: Bearer <YOUR_NIMT_PAT>
```

Replace the placeholder, including angle brackets, with your token in a secure
credential field. Do not put a token in a URL, repository, chat message, or
screenshot. Organization API keys are not personal access tokens for MCP.

## Use a token with Codex

Make `NIMT_PAT` available as an environment variable in the process that launches
Codex, using your secret manager or a secure shell prompt. Then configure a
separate token-based server entry:

```bash theme={null}
codex mcp add nimt-pat --url https://api.nimt.ai/mcp --bearer-token-env-var NIMT_PAT
```

This stores the environment variable's name in the configuration rather than the
token itself. You do not run OAuth login for this entry. If you also configured
Nimt with OAuth, disable the unused entry to avoid duplicate tools.

See [Codex's MCP documentation](https://developers.openai.com/codex/mcp) for its
remote server and bearer token settings. An app launched from your desktop may
not inherit variables exported in a terminal; the variable must be available to
the actual client process.

## Revoke or replace a token

In the token's workspace, return to **Settings → Personal access tokens**. Choose
**Revoke** next to an active token and confirm. Clients using it lose access.
Revoking a PAT does not disconnect a separate OAuth approval.

For routine rotation, create a replacement, update the client, verify that it can
list projects, and revoke the old token. If a token may have leaked, revoke it
immediately before creating a replacement. Expired tokens must also be replaced.