Personal access tokens
A personal access token acts as you. It belongs to your user account rather than to your organization, and is intended to be used for your own development machine.
Personal access tokens can be managed here.
For a token that a CI workflow or shared automation will use, create a service account instead. A service account is owned by the organization, so it survives you leaving it.
Permissions
A personal access token holds the permissions you choose when you create it. Everything available to you is selected by default, so a token you don't narrow can do everything you can do in that organization through the API and the CLI.
If you choose to scope a token rather than grant all your permissions, it will not inherit new permissions you are granted later.
Creating a token
RWX shows the token once, right after you create it. It starts with rwx_pat_. Store it somewhere safe; it can't be shown again.
Logging in with the CLI
rwx login creates a personal access token for you. You choose its organization and permissions in your browser when you authorize the device.
For programmatic use, set the token as the RWX_ACCESS_TOKEN environment variable instead of logging in. See the CLI docs for details.
Revoking a token
Deleting a token revokes it immediately and permanently. Create a new token to replace it.
Your tokens are also revoked when you leave the organization. If you need a token that may be used by your organization beyond your own tenure there, prefer a service account instead.