Personal access tokens

Personal access tokens authenticate scripts and the CLI as your BrainMaps account. They inherit that account’s permissions; they do not bypass contribution approval, ownership or atlas governance.

Create and use

Create a token in the website’s account settings, or from an existing authenticated session:

curl --fail https://api.brainmaps.xyz/api/tokens/ \
  -H "Authorization: Token $BRAINMAPS_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"name":"Lab workstation"}'

The creation response includes id, name and token, with timestamps/expiry information. Copy the raw token at creation and store it securely; use its UUID for management operations. Optional expires_at is an ISO 8601 timestamp. A null expiry means no scheduled expiry.

Use the same authentication scheme as login tokens:

Authorization: Token YOUR_TOKEN

Bearer is not accepted by the current authenticator.

List, revoke and delete

Method	Path	Behaviour
GET	`/api/tokens/`	List your non-revoked personal tokens; session tokens are excluded
POST	`/api/tokens/`	Create a named personal token
POST	`/api/tokens/{uuid}/revoke/`	Revoke a personal token
DELETE	`/api/tokens/{uuid}/`	Delete a personal token record

Do not interpret inclusion in the list as proof that a token has not expired; inspect expires_at. Expired/revoked tokens and inactive accounts cannot authenticate.

Logout revokes the token used for that request, not every token on the account. For credential rotation, create and configure a replacement, verify it works, then revoke the old token using a still-valid session.

CLI

brainmaps token create "Lab workstation"
brainmaps token list
brainmaps token revoke TOKEN_UUID

Use BRAINMAPS_API_KEY for automation or brainmaps token register "$BRAINMAPS_API_KEY" to save a token locally. The environment variable overrides saved credentials. Never commit tokens, config files or unredacted command output. See CLI authentication.

Models