Release Notes

All platforms - Command-line client: Personal Access Tokens are now available from the command line for Cloud organizations

Personal Access Tokens (PATs) allow you to authenticate non-interactive workflows (CI/CD, scripts, tools) against our Cloud service without sharing your password or compromising any other credentials.

You can use the cm accesstoken command family to manage your tokens. The PATs feature is opt-in, and access is controlled by the organization administrator — more on that later!

The process starts by creating a PAT. When using the command line (the feature is not yet available in the Cloud web portal), you must specify a description and a lifetime for the token. In this example, the token will be valid for 30 days:

$ cm accesstoken create "My script PAT" 30d my-org@cloud
          Id  2023d611-fa69-46c5-b8b4-4e405c780bb7
 Description  My Script PAT
       Owner  you@your-org.com
  Created at  8/4/2025 4:10:57PM
  Expires at  9/3/2025 4:10:57PM
Last used at  Never

Once the PAT is created, you can reveal it. Revealing the PAT displays the actual token you can later use in your workflows:

$ cm accesstoken reveal 2023d611-fa69-46c5-b8b4-4e405c780bb7 my-org@cloud
eyJhbGciOiJkpXVCJ9.eyJzdWIiOiIAyMn0.KMUFsI-QV30

$ cm ci -c="This checkin runs in our CI/CD VM" \
    --username=you@your-org.com \
    --token=eyJhbGciOiJkpXVCJ9.eyJzdWIiOiIAyMn0.KMUFsI-QV30 \
    --workingmode=LDAPWorkingMode \
    --server=my-org@cloud

Users can audit their own tokens: list them, check when they were last used, and delete them. Organization administrators can audit both their own tokens and the tokens of other users in the organization.

$ cm accesstoken list my-org@cloud
// A list with my own PATs

$ cm accesstoken admin list-all my-org@cloud
// A list with all the PATs in the organization

$ cm accesstoken revoke 2023d611-fa69-46c5-b8b4-4e405c780bb7 my-org@cloud
// Revoked my own PAT

$ cm accesstoken admin revoke 5d08dbec-edaa-4415-b709-25042fa13517 my-org@cloud
// Revoked a PAT from a different user in my organization

Organization administrators can also manage who has access to the PATs feature. As mentioned earlier, this is an opt-in feature rather than opt-out. This ensures that only privileged users and groups can grant access to organization data through a PAT.

$ cm accesstoken allowlist show my-org@cloud

To grant access to the feature to all current and future users, add the special user 'all' to the allowlist:

$ cm accesstoken allowlist add --users="all" my-org@cloud

To grant access to all users in a specific group (for example, "QA-hq"), add the group to the allowlist instead. If a user is removed from the group, they lose the privilege. Likewise, users added to the group gain the privilege.

$ cm accesstoken allowlist add --groups="QA-hq" my-org@cloud

The feature is currently available only through the command line client and will soon be available in the Cloud portal. Personal Access Tokens replace the old plasticscm.com 's feature named "API Keys", that could be accessed from the "Edit Account" section on the old dashboard.

It is worth mentioning that PATs are valid only for the account and organization they were created against, whilst the old API Keys were account-wide and granted access to all the organizations the user was a participant of.