api tokens

A personal access token (PAT) is how the CLI, the MCP server, and your own scripts authenticate against the same backend the web UI talks to. The browser uses session cookies; everything programmatic uses a PAT as Authorization: Bearer pngr_pat_….

A token acts as you — it inherits your org memberships and your role in each. There's no separate per-token scope system today.

minting a token

From /settings/api-tokens, create a token with a name and an optional expiry (never / 30 days / 90 days / 1 year).

warning

The raw token value is shown once, right after creation, in a "copy now" panel. pngr stores only a hash — it can't show you the value again. Copy it immediately and paste it into your CLI config or secret store.

using it

# one-time, on your machine
pngr auth login --token pngr_pat_…

# in CI — env var overrides the config file
PNGR_TOKEN=$SECRET pngr monitor list --output json

The same pngr_pat_… value goes in the PNGR_TOKEN field of an MCP client config.

lifecycle

List — /settings/api-tokens shows each token's name, a masked prefix (e.g. pngr_pat_aB3xQ7…) for visual identification, and its created / last-used / expiry timestamps. The raw value and the hash are never shown again.
Revoke — revoking takes effect immediately; the next request using that token gets a 401. Revoke is also how you "log out" the CLI for real, since pngr auth logout only clears the local copy.
Expiry — optional. A token with no expiry never expires; otherwise it stops working once expires_at passes.

note

The pngr_pat_ prefix is intentional — it's grep-able, so a leaked token is easy to spot in logs or a committed file. If one leaks, revoke it from /settings/api-tokens and mint a fresh one.

previousroles & permissions nextplans & billing