# Personal access token (PAT)

Canonical page: /glossary/personal-access-token

API keys & secrets glossary, Keys & secrets. Personal Access Token (PAT): How It Differs From a Password

**Short answer:** A personal access token, or PAT, is a credential you generate from your account settings on a service like GitHub, scoped to specific permissions and given its own expiry, separate from your login password. It is designed to be used by tools and scripts acting on your behalf.

## Why it matters

Because a PAT can be limited to, say, read-only access to one repository, a leaked PAT is far less damaging than a leaked password, which usually grants full account access.

## In Claude Keychain

A PAT is stored and used exactly like any other secret in Claude Keychain: saved once under a name you choose, and handed to a command as an environment variable only when you ask Claude Code to use it.

## Common questions

**Should a PAT ever be shared between two projects?**

You can reuse one, but a leak then affects every project using it. Separate tokens per project limit the blast radius.

**Do PATs expire automatically?**

Many services let you set an expiry date when you create one, and some default to a short lifetime.

## Related

[API key](/glossary/api-key), [API key scope](/glossary/api-key-scope), [Revoking an API key](/glossary/revoke-api-key)