How to Create Personal Access Tokens in CrmLeaf
All editions. Core feature - no add-on required. What a token can reach still depends on your permissions and on which add-on modules are enabled: vendor, purchase order, bill and payment data needs the…
Availability: All editions. Core feature - no add-on required. What a token can reach still depends on your permissions and on which add-on modules are enabled: vendor, purchase order, bill and payment data needs the Purchase module, and budget data needs the Budget module.
Overview
A personal access token is a credential you issue to yourself so that an application can act on your behalf in CrmLeaf. It is what you use to connect an AI assistant to your data, and to authenticate API access.
The token is not a way around your permissions. It acts as you, so it sees exactly what you would see in the interface.
How It Works
You create the token on your profile. It is pinned to the Company and Organization that were active when you created it, expires after 30 days by default, and is issued as either read-only or read-write. The application then sends the token with each request, and CrmLeaf applies your identity, your tenancy and your permissions.
Create token → Choose read-only or read-write → Copy the token → Configure the application → Actions audited → Revoke when finished
- The token is pinned to your Company and Organization. It reaches that workspace only. Switching workspace in the browser does not change what an existing token can reach.
- Default validity is 30 days.
- Read-only or read-write. Read-write is a coarse ability on the token, and every write is additionally re-checked against your own add and edit permission on the server. A token cannot give you access you do not already have.
- Nothing can be permanently deleted through AI assistant access. The tool set exposes reads and a set of create and update operations across Leads, Deals, Invoices, Projects, Products, Customers, Vendors, Purchase Orders, Bills, Payments and Budgets. There are no delete tools, by design.
- Every write is audited. An append-only audit trail records who acted, which token was used, the action, the record, the outcome and the field names submitted - never the values.
- CrmLeaf stays the authority. The AI assistant connection is a stateless translation layer that stores no credentials and holds no data of its own; it calls CrmLeaf as you and forwards your token on every request.
Who Can Use This Feature?
User
- Create your own tokens on your profile.
- Choose read-only or read-write for each token.
- Use the token to connect an AI assistant or an API client.
- Revoke a token you no longer need.
Access depends on the modules and role assigned by your Administrator. A token can never exceed the permissions of the user who created it.
Prerequisites
- You are signed in to the Company and Organization the token should apply to.
- Your role has the permission scopes for the data you want the application to reach.
- The add-on modules for that data are enabled for the account.
- A secure place to store the token, because it is a credential.
For Users
Step 1: Confirm you are in the right workspace
What to do: Check the active Company and Organization before you create the token. The token is pinned to both.
What to verify: The workspace shown is the one the application should reach.
Step 2: Open your access tokens
What to do: Open the access tokens area on your profile. Existing tokens are listed here.
What to verify: You can see the list of tokens issued for your user.
Step 3: Create the token
What to do: Add a token. Give it a name that identifies where it will be used, so you can revoke the right one later. Choose read-only unless the application genuinely needs to create or update records.
What to verify: The new token appears in your list with the access level you chose.
Step 4: Copy and store the token
What to do: Copy the token value and store it in the application's configuration or in a password manager. Treat it like a password. Do not paste it into a message, a document or a support ticket.
What to verify: The token is stored where the application can read it, and nowhere else.
Step 5: Configure the application
What to do: Enter the token in the application that will use it. To connect an AI assistant, follow the AI assistant connection article, which covers the assistant-side configuration.
What to verify: The application can read a list you know you have access to, and the records it returns match what you see in the interface.
Step 6: Revoke tokens you no longer need
What to do: Revoke a token as soon as its purpose ends, when you change device, or if you suspect it has been exposed. Do not wait for the 30-day expiry.
What to verify: The application stops working with the revoked token.
Field and Option Reference
| Field / Option | Description | Required |
|---|---|---|
| Token name | A label identifying where the token is used, so it can be revoked precisely. | Yes |
| Access level | Read-only, or read-write. Read-write is re-checked against your own add and edit permissions on every write. | Yes |
| Validity | How long the token remains usable. The default is 30 days. | Yes |
| Company and Organization | Set from your active workspace when the token is created. The token reaches that workspace only. | Set automatically |
Expected Result
A named token exists for your user, pinned to your Company and Organization, with the access level you chose and a validity period. The application you configured can reach exactly the records your permissions allow, and every write it performs is recorded in the audit trail.
Important Notes
- Menu names and their position can differ between product editions and can be customised for your account, so your sidebar may not match these paths exactly. Use Search or your Quick Access items if you cannot find a screen.
- A token acts as you. It cannot see or change anything you could not see or change in the interface, and each data type remains gated by its own permission and its add-on module.
- Choose read-only wherever possible. Read-write should be a deliberate decision.
- The token is pinned to one Company and Organization. Create a separate token for each workspace an application needs.
- Every write through a token is recorded in an append-only audit trail, including the field names submitted. The values are not recorded.
- AI assistant access exposes no delete operations, so an assistant cannot permanently remove your data.
- Treat a token as a credential. Store it securely, and revoke it when it is no longer needed or when you leave a project.
Common Scenarios
Example: asking an assistant about this week's deals. A sales manager creates a read-only token in their main workspace and connects their AI assistant. The assistant can summarise deals and check a project budget, but only within the records the manager's own permission scope allows, and it cannot change anything.
Example: drafting invoices. A finance user needs the assistant to create draft records, so they issue a read-write token. Each write is still re-checked against their own add and edit permission, and each one is recorded in the audit trail.
Example: two workspaces. A user works in two Organizations. Because a token is pinned to one workspace, they create one token per workspace and configure the application accordingly.
Troubleshooting
| Issue | Possible Cause | Resolution |
|---|---|---|
| The application returns fewer records than expected | The token inherits your permission scope, which may be owned or added | Ask your Administrator to review your scope for that module. |
| The application cannot see a data type at all | The required add-on module is not enabled, for example Purchase for vendors and bills, or Budget for budgets | Ask your Administrator to enable the module. |
| A write fails | The token is read-only, or your own add or edit permission does not allow it | Issue a read-write token, and confirm your permission scope allows the change. |
| The application worked and then stopped | The token expired - the default validity is 30 days - or it was revoked | Create a new token and update the application's configuration. |
| The application sees the wrong workspace | The token was created while a different Company or Organization was active | Switch to the correct workspace and create a new token there. |
| An assistant cannot delete a record | No delete operations are exposed, by design | Delete the record in CrmLeaf if you have the permission to do so. |
Frequently Asked Questions
Can a token give an application more access than I have?
No. The token acts as you. CrmLeaf applies your identity, your tenancy and your permission scopes on every request, and write actions are re-checked against your own add and edit permission.
How long does a token last?
30 days by default.
Can an AI assistant delete my data?
No. The assistant tool set includes reads and a set of create and update operations, but no delete operations.
Is my activity recorded?
Yes. Every write is recorded in an append-only audit trail with the user, the token, the action, the record, the outcome and the field names submitted. The submitted values are not recorded.
Do I need one token per workspace?
Yes, if the application must reach more than one. A token is pinned to the Company and Organization active when it was created.
Related Articles
Our support team answers on business days. Reference PLT-14 so we can jump straight in.