Skip to main content
Personal access tokens (PATs) are per-user bearer credentials. They’re how Cloud authenticates non-browser clients - MCP clients (such as Claude Code, Codex, Cursor, GitHub Copilot, OpenCode, and Google Antigravity) and CI scripts hitting the API. PATs:
  • Are per user, per org (pinned at mint time).
  • Carry the user’s role and identity into the request - just like a browser session would.
  • Are revealed once at mint and stored only as a SHA-256 hash on the Radar Cloud control plane.
  • Can be revoked instantly.
  • Show up in the audit log on create / use / revoke.
A PAT is one of two ways an agent authenticates - the other is OAuth. For the OAuth flow, managing connected apps, and the org-wide read-only switch that governs what any agent may mutate, see Connected apps & MCP access.

​
Mint a PAT

Open Agents, pick your client, and select Personal access token.
  • Choose an expiry: one year by default, or No expiry to keep it valid until revoked.
  • Click Generate.
The token starts with rhp_ and is shown once. Copy it now; you cannot retrieve it later. It is named for the selected client, and you can rename it after generation.

​
Use it - AI clients

The Agents page provides the setup snippet for your selected client. For an HTTP client:
For client-specific instructions, see AI via MCP.

​
Use it - HTTP API

Anything you can do in the UI you can do with a PAT - constrained by your role and your org’s RBAC.

​
Org pinning

A PAT is bound to one org at mint time, even if the user belongs to multiple. This makes audit trails clean (you know which org a token can act in) and keeps “switch org” semantics out of the MCP / CI surface area. If you need access to multiple orgs, mint one PAT per org.

​
Rotate

There’s no “rotate in place” - mint a new token, update the consumer, then revoke the old one. The Agents page shows tokens and their last-used timestamps.

​
Revoke

On Agents, revoke the token from its row. The next API call using it returns 401; an already-running request or stream is not canceled. Revoking emits a pat.revoked audit event.

​
When a member is removed

Membership removal and token revocation are separate. Org-scoped PATs fail new authorization checks while their owner is absent, but can work again if membership is restored. See removing a member.

​
Visibility

Users manage their own PATs on Agents. Organization owners can list and revoke org-scoped PATs under Settings → Organization → AI & MCP. Neither page reveals a token again after generation.

​
See also