Personal Access Tokens Controller

Introduction

The Personal Access Token Controller manages long-lived authentication tokens that allow users to access the AdmiralCloud API directly, without going through the interactive OAuth2 login flow. Personal Access Tokens are ideal for scripts, CLI tools, server-to-server integrations, and MCP or other AI-agent integrations where a user wants to authenticate as themselves rather than as a registered app.

Security Considerations

• Personal Access Tokens act as a substitute for a user's credentials and should be treated with the same level of confidentiality as a password.
• Tokens are shown in full only once, at creation time, and cannot be retrieved again afterwards.
• Assign only the scopes required for the intended use case to limit the impact of a leaked token.
• Set an expiration date whenever possible and revoke tokens immediately if they are no longer needed or may have been compromised.
• Regularly review active tokens to identify and remove unused or outdated ones.