Skip to content

Personal Access Tokens

PATs require a PRO workspace or higher

Creating Personal Access Tokens is a paid feature. See Plans & Limits for the full feature matrix.

On a FREE plan? Use a short-lived token

If you are on a FREE workspace, use a short-lived access token (cto_slt_v1_) from Settings > API Tokens for ad hoc queries and experimentation. Short-lived tokens are available on all plans, expire within hours, and are shown once at creation. For the UI quickstart, see Authentication.

Personal Access Tokens (PATs) are long-lived, self-issued credentials for scripts, cron jobs, server-side automation, third-party agents, and MCP clients that act as you. They are the simplest way to authenticate when no interactive browser flow is available or when the client is not a Contio-owned first-party app.

Shown once

The plaintext token is returned exactly once, at creation time. Store it securely (e.g. a secrets manager). If you lose it, delete the token and issue a new one — it cannot be recovered.

PATs are prefixed cto_pat_v1_ and are sent like any other bearer credential:

Authorization: Bearer cto_pat_v1_...

Issue a token

PATs are created through the Contio web app and cannot be minted through the API. This keeps the credential surface small and ensures the user reviews the token's scopes and expiry before it is revealed.

  1. Open the Contio app and go to Settings > Personal Access Tokens.
  2. Click New token.
  3. Enter a name, choose the scopes you need, and select an expiry.
  4. Copy the plaintext token immediately — it is shown only once.

The token is returned in the response shape below:

{
  "token": "cto_pat_v1_9f3c...",
  "metadata": {
    "id": "b2c1...",
    "name": "ci-pipeline",
    "scopes": ["meetings:read", "meetings:write"],
    "created_at": "2026-07-05T00:00:00Z",
    "expires_at": "2026-10-03T00:00:00Z"
  }
}

Creation fields

Field Notes
Name Human-readable label for the token
Scopes At least one scope; must be a subset of your own grants
Expiry One of 30, 60, 90, 180, 365 days

Scopes

PATs can be granted any subset of the user-scoped API scopes:

Scope Grants
meetings:read Read meetings, agenda items, and context
meetings:write Create, update, and delete meetings, agenda items, and context
action-items:read Read action items
action-items:write Create, update, and delete action items
calendar:read Read calendar events

Workspace scopes (workspace:read, workspace:write) are not available on PATs. Use a workspace API key for workspace-scoped admin automation so the credential is team-managed and revocable by any workspace admin.

Choose only the scopes the automation needs. The UI will reject any scope you do not hold, and it will block creation if you have reached your plan's cap on active credentials.

List your tokens

GET /v1/user/tokens returns your non-revoked PATs. Only a masked prefix is returned — never the full token.

curl "https://api.contio.ai/v1/user/tokens?limit=20&offset=0" \
  -H "Authorization: Bearer $CONTIO_TOKEN"

{
  "items": [
    {
      "id": "b2c1...",
      "name": "ci-pipeline",
      "scopes": ["meetings:read", "meetings:write"],
      "created_at": "2026-07-05T00:00:00Z",
      "expires_at": "2026-10-03T00:00:00Z"
    }
  ],
  "total": 1,
  "limit": 20,
  "offset": 0
}

Delete a token

DELETE /v1/user/tokens/{id} soft-deletes a PAT by its ID. Only the token owner can delete it. This is the way to rotate or immediately disable a credential.

curl -X DELETE https://api.contio.ai/v1/user/tokens/b2c1... \
  -H "Authorization: Bearer $CONTIO_TOKEN"

A successful delete returns 204 No Content.

Best practices

  • Scope minimally — request only the scopes the automation needs.
  • Set the shortest workable expiry and rotate on a schedule.
  • One token per workload — separate CI, cron, and local tokens so you can revoke one without disrupting the others.
  • Store as a secret — never commit a PAT to source control or embed it in client-side code.

See also