Access tokens

An access token lets something that is not a browser act as you: a script, a CI job, or the AI agent. It is the credential that makes everything on this page possible, so it is worth understanding before you issue one.

Issuing one

Settings → Access tokens → Create token.

Give it a name describing what it is for — Claude agent, nightly report. Once the secret is gone the name is the only way to tell your tokens apart.

Choose how long it should live. Ninety days is the default. No expiry exists for something running unattended that would break at renewal, but take it as a deliberate choice rather than the easy one.

The token is shown once. Copy it before you close the dialog. Noeto stores only a hash of it, so there is nowhere to read it back from — if you lose it, revoke it and issue another.

What a token can reach

A token is bound to the team you were in when you created it. It cannot switch teams and it cannot see another one. Working in two teams means two tokens.

Within that team it acts as you, with your role. It can do what you can do to boards, cards, comments and files.

It deliberately cannot:

• Switch teams, or accept an invitation to a new one. That would turn a token scoped to one team into access to another.
• Issue further tokens. Otherwise a leaked token could mint its own replacement, and revoking the one you knew about would achieve nothing.

Both answer with a message saying a signed-in session is required.

Taking one back

Settings → Access tokens → Revoke. It stops working on the very next request — validity is read from the database each time, not trusted from the token itself, so there is no window to wait out.

The list also shows when each token was last used. A token that has never been used is usually a setup somebody abandoned, and is worth revoking.

Leaving a team revokes its tokens for you. Being removed from a team cuts off the tokens you issued there, with nothing to remember.

Keeping one safe

Treat it like a password. It goes in a configuration file or a secrets manager, never in a chat message, a screenshot, or a repository. If it might have escaped, revoke it — issuing a new one takes ten seconds and costs nothing.