What is PAT?
A Personal Access Token (PAT is an authentication token i.e. it represents the fact that User has already authenticated. Hence it can be used for user authentication instead of user actually logging-in using their user/password via the User Agent. For security reasons, a PAT is linked to one and only one OAuth2 Client. You can think of PAT as a tuple of Authenticate User and the ClientID.
How to use a PAT?
Once the User has created a PAT (this is one time activity, see below) , the OAuth2 ClientID associated with this PAT can do an exchange to get Access and Refresh Token. This exchange doesn’t require the user to login and happens via an API call. The Access Token (AT) and Refresh Token (RT) are bound to the Authenticated User and the Client ID for the PAT. There is absolutely no difference between the AT, RT received via a PAT exchange vs. if the User and Client collaborated to do a 3-Legged Authcode flow with the user logging-in via the User Agent.
How many PATs that a user can generate?
A user is allowed to generate 7 PATs for commercial applications and 7 PATs for automation.
Creating a Personal Access Token
- Go to the My Profile and Settings page.
- Click on the Security tab on the left side navigation as shown below,

- On the Security page, click on Generate button under the “Personal access tokens” section. The Generate PAT window displays.


- In the Generate personal access token page, select the Application scope for which the token has to be generated, enter the Token name. Click Generate.

- The generated token would be displayed only once, the user can click Copy as shown below to copy the Token code.


- Click Done to close the window. The user will revert to the My Profile and Settings page, where the PAT generated is shown as below,

Revoking a Personal Access Token
- Go to the My Profile and Settings page.
- Click on the Security tab on the left side navigation as shown below,

- Under the Personal access tokens section, choose the Token name/application from the list of the token(s) that have to be revoked/deleted.
- Click Delete to revoke the PAT as shown below,

- Delete personal access token window is displayed. It requires confirmation from the user in order to proceed to delete the PAT.

- Click Yes, delete this token t to revoke the access token.
- Once the token is revoked, the following screen is displayed.

Passing a Personal Access Token to API call
- In addition to passing the Bearer token while making a call to the APIs, please pass PAT in the header ADSK-PAT.