An access token (PAT or service account key) moves through a small set of states.
- A token is created with its secret shown once; from then it is active.
- Expiry is enforced on every request. An expired token returns
401 Unauthorized and cannot be extended - create a replacement and revoke the old one.
- Revocation takes effect immediately - a revoked token fails on its next request.
Note that a valid token whose owner lacks the required permission still returns 403 Forbidden - that’s an authorization result, not a token state. Removing a user’s workspace access does not revoke their tokens; revoke them explicitly. See Token security best practices.
See also
Last modified on September 29, 2026
