Personal access token
A personal access token is a credential associated with a user account that software can present to a service for programmatic access within the token's permissions and the user's authority.
The account and the token both matter
A developer might use a personal access token for a script or command-line tool. The token is a secret, not a harmless identifier to paste into a support conversation.
On GitHub, both classic and fine-grained personal access tokens are tied to the generating user. Fine-grained tokens can restrict access to selected repositories and permissions; organization approval may also apply. Those are GitHub features, not a universal specification for every product called a PAT.
A PAT is not automatically an OAuth access token or an application client secret. Check the issuing platform’s credential type and permissions rather than treating everything named “token” as interchangeable.
When a personal token becomes an integration credential
A script using a PAT depends on the person’s account access as well as the token’s permissions. On GitHub, the token cannot grant authority its owner does not have. For long-lived integrations or access on behalf of an organization, GitHub recommends a GitHub App. That is worth considering before a personal token becomes a permanent dependency of a release process.
GitHub documents that an expired or revoked token can no longer authenticate Git and API requests. Revoking it does not undo changes already made or recover copied data. Our integration-token article covers that difference between stopping credential use and investigating its consequences.