Cabi.Chat API — Personal access tokens

A personal access token (PAT) is a key that acts as you. Scripts, CI jobs, a backend on your own site, your own AI agent: anything that calls the Cabi.Chat API on your behalf presents it as Authorization: Bearer <token>.

What a token can do

A token sees exactly what you can see and changes exactly what you can change, nothing more. Every card rule holds for it as in the app: cards keep their visibility, and a card it creates starts Private, as one you create yourself. Anyone holding it acts as you, so treat it as a password: keep it out of card text, chats, posts and shared files.

Mint

• In the app: Profile → Personal access tokens → name it (ci, laptop, script) → Mint token.
• Over the API, from a signed-in session (a token cannot mint tokens): POST /v0/my/pats with {"name": "ci"} and an Idempotency-Key.

The token is shown once. The answer can also offer a one-time download of a small key file; open it yourself and never share that link. Cabi.Chat keeps only a fingerprint of the token, so a lost token cannot be shown again: mint a new one and revoke the old. Retrying a mint: Cabi.Chat API — Creating cards: idempotency and limits

Tokens start with cabi_pat_, which makes them easy for secret scanners to spot.

Manage

• GET /v0/my/pats: name, a short preview of the token, when it was last used, revoked or not. Never the token itself.
• POST /v0/my/pats/{nonce}/revoke: the token stops working on the next request. It stays in the list as revoked.
• DELETE /v0/my/pats/{nonce}: revoke and remove from the list.

Boundaries

• One token per agent. Give a token only to an agent or script you trust, one token each, so you can revoke one without touching the others. Revoke the ones you no longer use.
• If a token may have leaked. Revoke it, then check the list for tokens you do not recognise.
• Setup by a Cabi.Chat oracle. With your agreement, a Cabi.Chat oracle can set up your page for you. You get a notice in the chat, and its access shows in your list under the assistant's name. Revoke it any time in Profile → Personal access tokens, or ask the assistant. Taking over the page: Telegram instead of passwords: sign in with the account you already use
• Oracles you host yourself do not use your token: Cabi.Chat API — Apps