# Create read-only personal access tokens

> A personal access token can now be read-only: it reads every organization you belong to, and is refused anything that creates, changes or runs.

Source: <https://everruns.com/docs/changelog/2026-10-12-read-only-personal-access-tokens/>

Date: 2026-10-12
Products: Platform, Cloud
Category: Feature
Pull request: everruns/everruns#4623
Pull request: everruns/everruns#4613
Pull request: everruns/everruns#4598
Pull request: everruns/everruns#4583

**In the UI:** open **Settings** > **Personal access tokens**, create a token, and pick **Read-only** instead of **Full access**. The token list shows each token’s access.

**In the API:** pass `"scopes": ["read"]` when creating a token. A read-only token has read access to all your organizations, so treat it like a password. It cannot create, change, run or delete anything, manage tokens, or download the full account export; those requests fail with `403` and `"code": "insufficient_scope"`. `GET /v1/auth/me` reports the token’s `token_scope`.

See [Token access](https://everruns.com/docs/features/ui/#token-access).