# Personal Token Best Practices

Source: https://userguide.qualytics.io/settings/access-tokens/personal-token/deep-dive/best-practices/

Follow these guidelines to keep your Personal Access Tokens secure and well-managed.

## Token Storage

- Yes Use a password manager or encrypted vault to store tokens.
- Yes Load tokens through environment variables in scripts and automation.
- Yes Encrypt tokens at rest.
- No Commit tokens to Git or any version control system.
- No Store tokens in plain or unencrypted text files.
- No Share tokens through email, chat, or other unsecure channels.
- No Reuse the same token across multiple environments.

## Token Naming

Use descriptive names that indicate the token's purpose. This makes it easier to identify and manage multiple tokens.

- Yes `cli-dev` — For Qualytics CLI during development.
- Yes `ci-pipeline-staging` — For CI/CD pipeline in the staging environment.
- Yes `notebook-exploration` — For ad-hoc API exploration in a Jupyter notebook.
- No `test` — Not descriptive enough.
- No `token1` — Too generic.
- No `my-token` — Unclear purpose.

> **Note**
>
> Token names must be unique per user. Duplicate names return a conflict error.

## Token Expiration Strategy

Choose expiration periods based on your use case:

| Use Case | Recommended Expiration | Notes |
| --- | --- | --- |
| **Development / testing** | 30, 60, or 90 days | Short lifespan aligns with active development cycles. |
| **CLI access** | 90 days | Balance between convenience and security. |
| **CI/CD pipelines** | 90 days or 1 Year | Longer lifespan for stable automation, with rotation before expiry. |
| **One-time scripts** | 30 days | Generate, use, then let it expire. |

> **Warning**
>
> Avoid using the **Never** expiration option. Tokens that never expire create security risks if compromised.

## One Token Per Purpose

Create separate tokens for different tools, scripts, or environments:

- One for the Qualytics CLI.
- One for your CI/CD pipeline.
- One for notebook exploration.

This makes it easy to revoke access for a specific use case without affecting others.

## Token Rotation

When a token is approaching expiration:

1. **[Generate](https://userguide.qualytics.io/settings/access-tokens/personal-token/managing/generate-token/)** a new token with a descriptive name (e.g., `cli-dev-2026`).
2. **Update** your scripts, environment variables, or secrets manager with the new token.
3. **Verify** that everything works with the new token.
4. **[Revoke](https://userguide.qualytics.io/settings/access-tokens/personal-token/managing/revoke-token/)** the old token.
5. **[Delete](https://userguide.qualytics.io/settings/access-tokens/personal-token/managing/delete-token/)** the revoked token.

## Revoke Compromised Tokens Immediately

If you suspect a token has been exposed:

1. **Revoke** the token immediately using the [Revoke Token](https://userguide.qualytics.io/settings/access-tokens/personal-token/managing/revoke-token/) action.
2. **Generate** a new token.
3. **Update** your scripts and configurations with the new token.
4. **Review** your recent API activity to check for unauthorized access.

> **Warning**
>
> Revoked tokens stop working instantly. Any script or tool using the revoked token will immediately lose API access.

## When to Use Personal Tokens vs Service Tokens

| Scenario | Use |
| --- | --- |
| Personal development and testing | Personal Token |
| Ad-hoc API exploration | Personal Token |
| Qualytics CLI access | Personal Token |
| Production pipelines and automation | [Service Token](https://userguide.qualytics.io/settings/access-tokens/service-token/introduction/) |
| Data catalog integrations | [Service Token](https://userguide.qualytics.io/settings/access-tokens/service-token/introduction/) |
| Shared automation across teams | [Service Token](https://userguide.qualytics.io/settings/access-tokens/service-token/introduction/) |

> **Tip**
>
> Personal Tokens are tied to your user account. If you leave the organization, any automation using your Personal Token will break. For production workloads, always use Service Tokens.

*Last updated: September 2, 2026.*