Use personal access tokens

To provide the PAT through an HTTP header, you must first convert it to a Base64 string. It can then be provided as an HTTP header in the following format.

Authorization: Basic BASE64_USERNAME_PAT_STRING

The following sample gets a list of builds using curl.

curl -u :{PAT} https://dev.azure.com/{organization}/_apis/build-release/builds

Modify a PAT

Do the following steps to:

• Regenerate a PAT to create a new token, which invalidates the previous one.
• Extend a PAT to increase its validity period.
• Alter the scope of a PAT to change its permissions.

1. From your home page, open user settings and select Personal access tokens.

2. Select the token you want to modify, and then Edit.

   

3. Edit the token name, token expiration, or the scope of access associated with the token, and then select Save.

   

Revoke a PAT

You can revoke a PAT at any time for these and other reasons:

• Revoke a PAT if you suspect it's compromised.
• Revoke a PAT when it's no longer needed.
• Revoke a PAT to enforce security policies or compliance requirements.

1. From your home page, open user settings and select Personal access tokens.

2. Under Security, select Personal access tokens. Select the token for which you want to revoke access, and then select Revoke.

   

3. Select Revoke in the confirmation dialog.

   

PAT Lifecycle Management APIs

The PAT Lifecycle Management APIs may be useful when maintaining large volumes of tokens through UI is unsustainable. Managing PAT rotation programmatically also opens the opportunity to rotate PATs regularly and shorten their default lifespans. Our sample Python app can be configured with your Microsoft Entra tenant and Azure DevOps organization.

Some things to note about these APIs:

• Microsoft Entra access tokens are required to access this API as generally a stronger form of authentication is recommended when minting new tokens.
• Only users or apps using an "on-behalf-of user" flow can generate PATs. Apps using "on-behalf-of application" flows or authentication flows that don't issue Microsoft Entra access tokens aren't valid for use with this API. As such, service principals or managed identities can't create or manage PATs.
• Previously the PAT Lifecycle Management APIs only supported the user_impersonation scope, but now the vso.tokens are available and the recommended scope to use with these APIS. Downscope all apps that previously relied on user_impersonation to call these APIs.

Changes to format

As of July 2024, we updated the format of PAT strings to improve secret detection in our leaked PAT detection tooling and partner offerings. This new PAT format includes more identifiable bits to improve the false positive detection rate in these detection tools and mitigate detected leaks faster.

• New tokens are now 84 characters long, with 52 characters being randomized data. This improves overall entropy, making tokens more resistant to brute force attacks.
• Tokens issued by our service include a fixed AZDO signature at positions 76-80.

If you are using a PAT issued prior to that data, regenerate your PAT. If you integrate with PATs and have PAT validation built-in, update your validate code to accommodate both new and existing token lengths.

Best practices for using PATs

Consider alternatives

• Acquire a Microsoft Entra token via the Azure CLI for ad-hoc requests instead of minting a longer-lived PAT.
• Use credential managers like Git Credential Manager or Azure Artifacts Credential Manager to simplify credential management, with authentication set to oauth or Microsoft Entra tokens.

Creating PATs

• Don't put personal data in the PAT name. Don't rename the PAT name to include some or all of the actual PAT token.
• Avoid creating global PATs unless necessary across all organizations.
• Use a different token per flow or user case.
• Choose the minimally needed scopes per PAT. Create a separate PAT with fewer scopes for each flow, instead of a single full-scoped PAT for all flows. If your PAT needs read-only permissions, don't provide write permissions until necessary.
• Keep PAT lifespans short (weekly is ideal, even shorter is better).

Managing PATs

• Don't share your PATs!
• Store your PATs in a secure key management solution, like Azure KeyVault.
• Regularly rotate or regenerate your PATs via UI or PAT Lifecycle Management APIs.
• Revoke PATs when no longer needed.
• Rotate your PATs to use the new PAT format for better leaked secret detection and revocation by our first-party tools.

For admins

• Tenant admins can set policies to restrict global PAT creation, full scoped PAT creation, and long-lived PAT duration.
• Tenant admins can revoke PATs for their organization users if the PAT is compromised.
• Organization admins can restrict PAT creation in an organization. If PATs are still needed, limit their creation to only those on the allowlist.

FAQs

Q: Why can't I edit or regenerate a PAT scoped to a single organization?

A: Sign into the organization where your PAT is scoped. You can view all your PATs while signed into any organization in the same Microsoft Entra ID by changing the Access scope filter, but you can only edit organization-scoped tokens when signed into the specific organization.

Q: What happens to a PAT if a user account is disabled?

A: When a user is removed from Azure DevOps, the PAT invalidates within 1 hour. If your organization is connected to Microsoft Entra ID, the PAT also invalidates in Microsoft Entra ID, as it belongs to the user. We recommend rotating the PAT to another user or service account to keep services running.

Q: Can I use PATs with all Azure DevOps REST APIs?

A: No. You can use PATs with most Azure DevOps REST APIs, but organizations and profiles and the PAT Management Lifecycle APIs only support Microsoft Entra tokens.

Q: What happens if I accidentally check my PAT into a public repository on GitHub?

A: Azure DevOps scans for PATs checked into public repositories on GitHub. When we find a leaked token, we immediately send a detailed email notification to the token owner and log an event in your Azure DevOps organization's audit log. We encourage affected users to mitigate the issue by revoking the leaked token and replacing it with a new token.

Unless you disabled the Automatically revoke leaked personal access tokens policy, we immediately revoke the leaked PAT. For more information, see Revoke leaked PATs automatically.

Q: Can I use a personal access token as an ApiKey to publish NuGet packages to an Azure Artifacts feed using the dotnet/nuget.exe command line?

A: No. Azure Artifacts doesn't support passing a PAT as an ApiKey. When using a local development environment, we recommend installing the Azure Artifacts Credential Provider to authenticate with Azure Artifacts. For more information, see the following examples: dotnet, NuGet.exe. If you want to publish your packages using Azure Pipelines, use the NuGet Authenticate task to authenticate with your feed. See example.

Q: Why did my PAT stop working?

A: PAT authentication requires you to regularly sign into Azure DevOps using the full authentication flow. Signing in once every 30 days is sufficient for many users, but you might need to sign in more frequently depending on your Microsoft Entra configuration. If your PAT stops working, first try signing into your organization and complete the full authentication prompt. If your PAT still doesn't work, check if it expired.

Enabling IIS Basic Authentication invalidates using PATs for Azure DevOps Server. We recommend that you keep IIS Basic Authentication turned off always.

git -c http.extraheader='Authorization: Basic [base 64 encoding of "user:password"]' ls-remote http://tfsserver:8080/tfs/DefaultCollection/_git/projectName

Q: How do I create access tokens that aren't tied to a person?

A: All PATs are associated with the user identity that created it. Applications can't create PATs.

In Azure DevOps, you can create access tokens that aren't tied to a specific person by using Microsoft Entra tokens minted by an application service principal or managed identity. Within a pipeline, use service connections.

Q: How can I regenerate/rotate PATs through the API? I saw that option in the UI, but I don’t see a similar method in the API.

The 'Regenerate' functionality available in the UI actually accomplishes a few actions, which can be replicated through API.

To rotate your PAT, do the following steps:

1. See PAT metadata with a GET call,
2. Create a new PAT with the old PAT id using a POST call,
3. Revoke the old PAT using a DELETE call.

Q: I see a "Need admin approval" pop-up when I try to use an Entra app to call the PAT Lifecycle Management APIs.

Your tenant's security policies require admin consent before applications can access organization resources in the organization. Reach out to your tenant admin(s).

Q: Can I use a service principal to create or manage PATs?

No, personal access tokens belong to a user identity. Entra service principals or managed identities are able to generate short-lived Entra tokens that can be used in most places where a PAT is accepted. Learn more about our efforts to reduce PAT usage across Azure DevOps and explore replacing PATs with Entra tokens.

Related articles

• Use policies to manage personal access tokens for users
• Revoke user PATs (for admins)
• Authenticate with Microsoft Entra tokens