Personal Access Tokens (PATs)

What are Personal Access Tokens (PATs)

Personal Access Tokens (PATs) are time-limited, scope-based tokens used to authenticate API requests without using username/password credentials.

PATs are intended for programmatic access, automation, CLI usage, and third-party integrations.

Use Personal Access Tokens when you need:

To create a Personal Access Token using the Cube AI UI:

Log in to the Cube AI UI
Navigate to Profile → Personal Access Tokens
Click Create
Provide the required information:
- Name — a unique name for the token
- Duration — token validity period
- Scopes — allowed resources and operations
Click Create and copy the generated token

⚠️ The token value is displayed only once.
Store it securely, as it cannot be retrieved again.

Create PAT dialog

When creating a PAT, you must define its validity period.

The token will automatically expire after the selected duration. Expired tokens can no longer be used for authentication.

PATs in Cube AI are scope-based.

Each token must define one or more scopes.

A scope defines what action can be performed on which resource.

Each scope contains:

Entity Type — the type of resource (for example domains, models, or datasets)
Entity — the specific resource instance
Operation — the action that is allowed

Only operations explicitly defined in the configured scopes are authorized.

Cube AI Personal Access Tokens use a fine-grained authorization model based on scoped operations.

Each scope defines what action can be performed on which resource.

A scope contains three components:

Entity Type — the category of resource, such as domains, models, or datasets
Entity ID — the specific resource instance
Operation — the permitted action

This model allows precise control over automated access.

For example, a token can be configured to:

Only operations explicitly defined in the configured scopes are authorized.

Scopes are configured in the Scopes section when creating or updating a PAT.

To add a scope:

You can repeat the process to add multiple scopes to the same token.

PAT scope selection

Cube AI supports a number of operations that can be assigned to PAT scopes.

Available operations depend on the selected entity type and the permissions assigned to the user.

Operation	Description
Read	View resource information
Update	Modify existing resources
Delete	Remove resources
Enable	Enable a disabled resource
Disable	Disable a resource
Manage Role	Manage role permissions
Add Role Users	Add users to a role
Remove Role Users	Remove users from a role
View Role Users	View users assigned to a role
LLM Create	Create a new LLM configuration
LLM Update	Modify an existing LLM configuration
LLM Read	View LLM configuration
LLM Delete	Remove an LLM configuration
LLM Chat Completions	Generate chat responses from an LLM
LLM Completions	Generate text completions
LLM Embeddings	Generate vector embeddings
LLM Transcription	Convert audio to text
LLM Translation	Translate text
LLM Utility	Access utility operations related to LLM services