# Personal Access Tokens

> Create a scoped token for the BH CLI and API access, and rotate it when needed.

## Creating a Token

1. Open Settings → Personal Access Tokens (`/settings/pat/new`).
2. Give the token a name (e.g. `laptop-bh`) and select the minimum scopes it
needs (see [Scopes](/developer/scopes)).
3. Save the displayed token value — it is shown once.

## Using the Token

```bash
export BOUNTYHUB_TOKEN="<your_personal_access_token_here>"
bh blob upload --src ./wordlist.txt --dst "wordlists/dirs.txt"
```

The [BH CLI](/bh/overview) reads the same token; every command authenticates
with the scopes you granted. If a command fails with an authorization error,
the token is missing the scope for that area — add it in Settings and rotate:

- Token management itself (list vs create/update/delete/rotate) is gated by
the Personal Access Tokens scope.
- Browser OAuth flows (e.g. Slack install) stay cookie-only and never accept
a PAT.

## Scope Rules

Write scopes require their read scope, and subservice scopes require their
parent (datasets need Projects read; Workflow LSP needs Workflow read).
The editor selects parents automatically. Full list:
[Scopes](/developer/scopes).