A token tied to a user that replaces a password when calling GitHub or Azure DevOps APIs, using Git, or reaching package feeds. Keep its scope tight and its lifetime short, and choose Microsoft Entra tokens, workload identity federation or GitHub Apps instead wherever you can.
Also called PAT.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Personal access token in context, with comparison tables and the common traps.
Terms in this definition
- Token
The unit of text an LLM works with, which may be a word, part of a word or punctuation. Billing, limits and context windows are all counted in these units.
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- Azure DevOps
Microsoft's suite of DevOps services, among them Azure Boards and Azure Pipelines.
- Git
A distributed version control system. Anything kept in Git, prompts included, gains a history of authors, timestamps, diffs and tags, and changes can be reverted.
- Scope
Where an access or policy assignment takes effect. It can be set on a single resource, a resource group, a subscription or a management group, and settings flow down from higher levels.
- Microsoft Entra
The umbrella brand covering Microsoft's identity and network access portfolio. Internet Access, Private Access, External ID and ID Governance all belong to it, built on top of the core directory service, Entra ID.
- Federated identity credential
Lets an outside workload, GitHub Actions or Kubernetes for instance, obtain an Entra token in exchange for its own token, so no secret has to be stored.
Related terms
- Global PAT
A personal access token covering every Azure DevOps organisation its owner belongs to. On 1 December 2026 all such tokens cease to function; move to tokens tied to a single organisation, or Microsoft Entra sign-in.
- IP Conditional Access policy validation on non-interactive flows
Once a Project Collection Administrator switches on this Azure DevOps organisation policy, IP-based Conditional Access rules from Entra also apply to calls with no user present, for instance REST requests using a PAT.