> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/reference/admin-api/personal-access-tokens.md).

# Personal access tokens

The tokens the Terra CLI and MCP clients sign in with, and how to mint, rotate, and revoke them.

Every admin API request carries a personal access token. You get one by signing in: `terra login` creates one for the CLI, and connecting an MCP client creates one for that client.

**Settings > Personal Access Tokens** in the [dashboard](https://dashboard.tryterra.co/dashboard/settings/personal-access-tokens) lists every token on your account and how it was created. To run the CLI where no one can sign in, such as CI, mint a token there and set it as `TERRA_ADMIN_TOKEN`. See [Authentication](https://docs.tryterra.co/developer-tools/terra-cli/authentication).

## Permissions

A token acts as you. It can never do more than your team role allows, and it stops working if you leave the team or your role is lowered.

Each token holds a set of [scopes](/reference/admin-api/scopes.md) that you approve when you sign in or mint it. A token can also be limited to some environments.

## Lifetime

A token works until it expires or is revoked. Tokens from `terra login` last 30 days; a minted token lasts 7, 30, 60, or 90 days. `terra tokens rotate` swaps a token for a new one, for up to 90 days after it was first created. After that, sign in again.

## Revoke a token

`terra logout` revokes the CLI's token. Account admins can revoke any token from **Settings > Personal Access Tokens** or with `terra tokens delete <token_id>`. Revocation takes effect on the next request.