Pleased logoDocs

Generating Access Tokens

Last edited 20/10/2026 by Connor Paterson

Permissions: Workspace Admin or configured role permissions

Where it is

  • Settings → Manage → Access Tokens
  • Visible to admins only (agents do not see the nav item)

What the page is for

Personal access tokens authenticate external integrations with the workspace or more specifically, systems that will call Pleased’s external-events API. Think of them like a long-lived API key for that integration that ensures only your events reach Pleased

Personal access tokens function like OAuth access tokens and can be used to authenticate API requests.


List page

  • Columns - Token name, Note, Created date
  • Not shown - The secret itself, who created it, hash
  • Actions - Revoke/delete only (no edit, no regenerate, no “reveal”)
  • Empty state - “No personal access tokens” — CTA to generate
  • Pagination - Present on the reskin UI (25 per page)

Create flow (walkthrough steps)

  1. Open Settings → Access Tokens.
  2. Select Generate new token.
  3. Enter:
  • Token name (required, max 100) — must be unique among External Events tokens
  • Note (required in the UI, max 255) — who/what uses it
  1. Read the lifetime note: tokens do not expire until revoked.
  2. Confirm → secret is shown once.
  3. Copy the token to a secure store (password manager / secrets vault used by the integration team).
  4. Select Done. Closing without copying means creating a new token and revoking the unused one.

Warning copy to reuse:

Make sure to copy your personal access token now. You won't be able to see it again.

Revoke flow

  1. On the list, open revoke/delete for the row.
  2. Confirm. Copy:
Are you sure you want to revoke "{name}"? Any integrations using this token will stop working immediately.
  1. There is no dependency check against External Event rules - rules stay configured; the integration simply fails authentication until a new token is used.

Best practices

  • Create a separate token for each integration. For example, have one token for “Grafana payment alerts” and another for “Risk engine”. Don’t share a single token across the whole workspace.
  • Give every token a clear name and note. It should be obvious who owns the token and which system uses it.
  • Rotate tokens without downtime. Create the new token first, update the integration to use it, then revoke the old one.
  • Protect the secret like a password. Never paste it into chat messages or support tickets, and never show it in screenshots.