# Manage and use personal access tokens

A personal access token (PAT) authenticates scripts and applications with the Lumicast API **as you**. Unlike a workspace [API key](/how-to/api-keys), which is tied to a single workspace and role, a token acts with the permissions you hold in **every workspace you belong to**.

::: warning
A token can do everything your account can. Treat it like a password — never share it, and give it the smallest scope and shortest lifetime that still works.
:::

## Creating a token

1. Open your account **Settings**.
2. Go to the **Access tokens** tab.
3. Click **Create token**.
4. Give the token a name, then choose:
   - **Scope** — **Full access** (everything you can do, in every workspace you belong to) or **Read-only** (can read data but never modify it).
   - **Expiration** — 30, 60, or 90 days, or no expiration.
5. Click **Create**. Copy the token value shown — for security it is **only displayed once** and cannot be retrieved again.

Every token value starts with the `lcp_` prefix.

## Using a token

The base URL for the API is `https://api.lumicast.com`. Authenticate your requests by adding an `Authorization` header:

```http
Authorization: Bearer <YOUR_TOKEN>
```

Refer to the [Lumicast API documentation](https://api.lumicast.com/docs) for the full list of endpoints.

::: info
A **read-only** token may only perform read requests. Any request that creates, changes, or deletes data is rejected.
:::

## Rotating a token

Rotating generates a new token value and keeps the name, scope, and expiry. The previous value stops working immediately, so update anything using the token with the new value. Use the **rotate** action next to a token in the list, then copy the new value (again shown only once).

## Revoking a token

Use the **delete** action next to a token to revoke it. Anything still using that token loses access immediately.