Skip to content
English
  • There are no suggestions because the search field is empty.

How to create and use Personal Access Tokens (PATs)

What are Personal Access Tokens (PATs) and how do I use them?

Personal Access Tokens (PATs)

Personal access tokens (PATs) are read-only API credentials for reporting and integrations. A PAT lets your scripts and tools pull data from the Foundry USA Pool API without using your login credentials or sharing your password. Each token is scoped to your own access, so it can only read data you can already see when logged in.

Key facts

  • PATs are read-only. They cannot make changes to your account.

  • You can have up to 2 active tokens at a time.

  • Every token has an expiration date, up to 1 year from creation.

  • The token value is shown exactly once, when it is created. It cannot be viewed again.

  • Tokens start with the prefix fdpat_ so they are easy to identify.


Who can create tokens

The Personal Access Tokens tab is available to users with the Owner or Accountant role in at least one group. Users with only the Technician role will not see the tab.

Creating a token

  1. Click your avatar in the top-right corner and select My Profile.
  2. Open the Personal Access Tokens (PAT) tab.
    01-pat-tab

  3. Click Create Personal Access Token.

  4. Enter a Label that describes what the token is for (for example, "Monthly reporting script") and choose an expiration date. Expiration defaults to 31 days out and can be set up to 1 year from today.
    02-create-dialog

  5. Click Create.


Copying your token


After you create (or rotate) a token, its full value is displayed one time.

03-reveal-token-1
Important: This is the only time you will see this token. Copy it now and store it securely. You will not be able to view it again. The Close button stays disabled until you have copied the token.
If you lose a token, you cannot recover it. Rotate the token to get a new value, or revoke it and create a new one.

Using your token

Send the token in the Authorization header of your API requests:


curl -H "Authorization: Bearer fdpat_XXXXXXXXXXXXXXXX"
"https://api.pool.foundrydigital.com/<endpoint>"


Managing your tokens

The Personal Access Tokens tab lists all of your tokens with their status and usage details.

  • 04-token-tableToken shows only the first characters (fdpat_...) for identification. The full value is never displayed after creation.

  • Last Used and Used From IPs help you confirm a token is being used where you expect. If you see an IP address you do not recognize, revoke the token.

  • Status is Active, Expired, or Revoked. Active tokens within 7 days of expiring are highlighted, and a banner appears above the table.

Rotating a token

Rotating generates a new token value and immediately revokes the old one. Any integrations using the old token will stop working until you update them with the new value. Use rotate for routine credential hygiene or if you suspect a token has been exposed.

05-rotate-confirm

Revoking a token

Revoking immediately disables a token. Any integrations using it will stop working. This cannot be undone.

Expiration reminders

You will receive an email reminder as a token approaches expiration: 30 days, 7 days, and 24 hours before it expires. The website also shows a warning banner on the Personal Access Tokens tab when a token expires within 7 days.

Security best practices

  • Treat a PAT like a password. Store it in a secrets manager, and never commit it to source code.

  •  Create a separate token for each integration so you can revoke one without breaking the others.

  • Choose the shortest expiration that works for your use case.

  • Revoke tokens you no longer use, and rotate immediately if a token may have been exposed.