Personal access token

The structure of an e6data personal access token (PAT) and how it's stored.

A personal access token (PAT) is a four-part, underscore-separated string carrying a human user's identity.

e6pat_<workspace>_<keyId>_<secret>

Segment	Meaning
e6pat_	The PAT prefix - checked before any lookup; a value without it is rejected
<workspace>	The workspace the token is scoped to - it is not valid in any other workspace
<keyId>	An identifier for the key
<secret>	The secret material you must protect

• The full value is shown once, at creation - only its prefix is stored or shown afterward.
• The token is workspace-scoped and carries identity only; what it can do comes from the user's role bindings, not the token itself.

The other credential prefix is e6sa_ (service account key). See the canonical token-types table.

See also

• Service account key format
• Token lifecycle states
• Token expiry rules
• Access tokens