---
title: API tokens
description: Generate, save, inspect, and revoke credentials for the Olibato CLI and REST API.
audience: developer
status: current
last_updated: 2026-09-02
order: 20
related:
  - /v/docs/getting-started/quickstart.md
  - /v/docs/api/index.md
---

Olibato personal access tokens authenticate the CLI and REST API as your user.
The token can perform only the actions allowed by both its permission level and
your role in the target namespace. A token does not turn an organization member
into an admin or owner.

## Generate a token

1. Sign in and open **Account**.
2. Find **API access** and choose **Generate token**.
3. Give the token a name that identifies the laptop or automation using it.
4. Choose an expiration period. Ninety days is selected by default.
5. Keep the recommended **Write** permission for `olibato push`, or choose **Read** for inspection-only automation. Use **Owner** only for credential management or irreversible operations.
6. Choose **Generate token**.

Write permission can read namespaces and sites, create deploys, upload temporary
source, update site settings, and operate runtimes. It does not include
credential management or irreversible owner operations.

The same lifecycle is available through the API. `POST /auth/registration/verify`
returns the first owner token for a newly verified API account. Existing owner
tokens use `GET|POST /account/tokens` and `DELETE /account/tokens/{id}`.

## Save the token

The complete `oli_pat_…` value is displayed once. Copy it before leaving or
refreshing the page:

```bash
olibato login --token "oli_pat_…"
```

The CLI saves the credential in the operating-system credential store. For
headless automation, set `OLIBATO_TOKEN` in the job's protected secret store
instead of writing it to a repository or configuration file.

Olibato does not retain the complete token. The Account page stores and displays
the token name, safe prefix, permissions, creation and expiration dates, last-use
time, and status. Authentication uses a keyed verification hash that cannot be
turned back into the original token.

## Review and revoke tokens

The **API access** table lists active, expired, and revoked credentials. Use the
last-used time to identify abandoned credentials. Choose **Revoke** to disable a
token immediately; applications using it will begin receiving authentication
errors. A revoked or lost token cannot be restored—generate a replacement and
update the consuming CLI or automation.

Use separate tokens for separate laptops and automated jobs. This makes a single
credential safe to revoke without interrupting every integration.

## Recover API-only access

If every owner token is lost, send the account email to
`POST /v/api/v1/auth/token-recovery`. The response is always accepted so it
does not reveal whether an account exists. For an active account, Olibato emails
a short-lived, single-use recovery secret. Exchange it at
`POST /v/api/v1/auth/token-recovery/confirm` to create a replacement owner
token. Store the returned token immediately; its complete value is not shown
again.