Skip to content

09 Personal Access Tokens

Personal access tokens (PATs) are the safest way to automate against Athene without reusing account passwords. Use PATs for CI/CD jobs, integration scripts, and service accounts where credentials must be scoped, rotated, and revoked independently of interactive operator login.

In practice, PATs help you:

  • Avoid putting human passwords into pipeline configuration.
  • Rotate automation credentials without forcing user password resets.
  • Revoke one integration quickly when a token is exposed or no longer needed.
  • Keep interactive login and non-interactive automation credential paths separate.

9.1 Prerequisites

  • Existing user account from 07 User and Access Control (examples use alice).
  • Authentication enabled on the Athene server.
  • Athene CLI available in your shell as athene.

9.2 Quick Start

Step 1: Create a PAT for alice

athene user create-pat --name "alice-ci" --expires-on 2027-01-31

Example output:

Copy this token now. It will never be shown again.
alice:3tRZ8nP7xQ4mL9vK2aBcD5eFgH1jN6sUyW0pQa
Use this value directly with ATHENE_PAT or --pat.

Save this value securely. You will use this same PAT in the next chapter.

Step 2: List PATs and confirm it exists

athene user list-pats

Example output:

alice:6fdf6ffc-ed77-4f31-bf14-6cc8c8b95a21  alice-ci    2026-07-24  2027-01-31  active

9.3 Key Parameters Explained

  • user create-pat --name <label>: creates a new token and prints the one-time <username>:<token> credential.
  • --expires-on <yyyy-mm-dd>: token remains valid through that UTC date.
  • --never-expires: creates a non-expiring token (use only with strong rotation policy).
  • user list-pats: lists your token records, including token id, label, dates, and active/expired status.

Tip

Use one PAT per integration system (for example separate Jenkins and release automation tokens). This makes revocation and audit much cleaner than sharing one token across multiple tools.

9.4 Other Ways to Create a PAT

9.5 Next Steps

You should now have a PAT for user alice and have verified it with athene user list-pats.

In the next chapter you will use that PAT for one-shot authentication (--pat and ATHENE_PAT) and script-friendly login workflows.

Next chapter: 10 Authentication and Tokens.