---
title: Personal Access Tokens for the Testomato API
date: 2026-10-01
description: Create named, revocable API tokens with their own expiration in your account settings. Old tokens stop working, so scripts and MCP clients need a new one.
excerpt: Named, revocable API tokens with their own expiration. Existing tokens stop working — here is what to update.
author: Roman Ožana
categories: [Updates]
---

import Callout from '../../components/post/Callout.astro';
import BlogCTA from '../../components/post/BlogCTA.astro';

You can now create **personal access tokens** for the [Testomato API](https://help.testomato.com/api/) and for AI clients connected through our [MCP server](/mcp-server/). Each token has a name and an expiration, and you can revoke it at any time.

<Callout type="warning" title="Existing tokens stop working">
With this change, every API token issued before it is no longer valid — including tokens pasted into MCP client configs (Claude, Cursor, VS Code). Create a personal access token and replace the old one.
</Callout>

## Why we changed it

Until now, an API token was valid forever and there was no way to cancel one. If a token leaked from a CI log or a shared config file, it kept working.

Now every token has a lifetime, and the ones you create yourself can be revoked from one place.

## How to create a token

![Testomato API tokens section in account settings](./access-token.png)

1. Open <a href="/app/user/settings#api" rel="nofollow">Account settings → Testomato API tokens</a>.
2. Name the token after where you will use it, for example *CI pipeline* or *Claude*.
3. Pick a lifetime: 30 days, 90 days, 1 year or no expiration.
4. Click **Create token** and copy it. It is shown only once.

The list shows when each token was created, when it was last used and when it expires. **Revoke** cancels a token immediately — anything that uses it stops working on the next request.

You can have up to 15 active tokens.

See [API tokens](https://help.testomato.com/account/api-tokens/) in the help docs for how to use and manage them.

## Short-lived tokens for scripts

`POST /api/authenticate` still returns a token for your e-mail and password, but that token now expires after 1 hour by default and after 1 day at most. It suits a script that logs in, does its job and exits. For anything that runs unattended, such as an MCP client or a scheduled job, use a personal access token.

## Automatic revocation

When you change or reset your password, all your personal access tokens are revoked. If you suspect an account compromise, a password change cuts off every integration at once. Deleting your account removes your tokens as well.

Happy accessing!

<BlogCTA>
	<span slot="title">Connect your scripts and AI tools to Testomato</span>
</BlogCTA>