> ## Documentation Index
> Fetch the complete documentation index at: https://docs.speckle.systems/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs contain multiple Speckle product experiences. For Speckle 2026.9, prefer /next/ pages for the topics and changes they cover. The navigation label Current does not override this version-specific precedence.
> Coverage under /next/ is incremental. Use Current documentation for unchanged topics and when a /next/ page says coverage is unavailable or explicitly refers you to Current. Do not infer a feature was removed from a missing page.
> Read the page-specific documentation status, applicability, affected guidance and replacement links in agent-only content. Impacted, changed and superseded apply only to the stated scope; they do not mean the entire feature is deprecated. Historical connector guides apply only to the legacy connector described.
> Match guidance to the customer's deployment version, model data format and connector. Respect plan, permission and compatibility restrictions. If an unknown version or data format changes the answer, ask a focused clarification; do not infer deployment version from the date alone.

# Building with PATs

> Understanding Personal Access Tokens (PATs).

Documentation status: changed for the changes in Speckle 2026.9 (from 2026-09).

Affected guidance: Workspace navigation and the user-settings entry point.

For these changes, read [2026.9 guidance](/next/workspaces/introduction).

For Speckle 2026.9, prefer the linked guidance only for the affected topics. This page remains applicable to earlier experiences and unchanged guidance. Do not treat the whole page or feature as deprecated.

## Using PATs

**Best for:** Single-user tools, server-side applications, scripts, and automations.

Personal Access Tokens allow users to authenticate and interact with the Speckle API on their own behalf. They're ideal for:

* Command-line tools
* Server-side applications
* Automation scripts
* Single-user integrations

PATs can be used with any Speckle SDK or API:

* **Python SDK** - See [Python SDK Authentication Guide](/developers/sdks/python/getting-started/authentication) for detailed examples
* **GraphQL API** - Include token in `Authorization: Bearer YOUR_TOKEN` header
* **JavaScript/TypeScript** - Use tokens in API client configuration

<Warning>
  **Never use PATs in client-side code.** They provide full access to the user's account and should
  only be used in secure, server-side environments.
</Warning>

<Warning>
  **Store tokens securely!** Treat them like passwords—never commit them to version control or share
  them publicly. Use environment variables or secret management systems in production.
</Warning>

## Getting a Personal Access Token

<Steps>
  <Step title="Log into Speckle">
    Go to your Speckle Server (e.g., [app.speckle.systems](https://app.speckle.systems))
  </Step>

  <Step title="Access Your Profile">
    Open the workspace switcher (the workspace name at the top of the left sidebar), select your
    name, then open **Developer**. Your name is the link to User settings, not only a signed-in
    label. See [Open user settings](/next/workspaces/introduction#open-user-settings).
  </Step>

  <Step title="Create Token">
    Click "New Token", give it a name, select the required scopes, then copy the token.
  </Step>
</Steps>

When creating tokens or registering applications, request only the minimum necessary scopes. This principle of least privilege reduces potential security risks.

## Using the Token

When making API requests, include the token in the `Authorization` header:

```javascript theme={null}
fetch('https://app.speckle.systems/api/graphql', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: `Bearer YOUR_TOKEN`
  },
  body: JSON.stringify({ query: YOUR_GRAPHQL_QUERY })
})
  .then((response) => response.json())
  .then((data) => console.log(data))
```

This request will act on behalf of the user who owns the token, with permissions defined by the selected scopes. This means if you have a token with `streams:read` scope, you can read project data but cannot modify it.