Overview
A Personal Access Token (PAT) is a user-scoped credential you can mint from your account and use to authenticate API calls as yourself — outside of the normal browser login flow. It's the credential that powers programmatic and agent access to Postnomic, including the MCP server (see the MCP Server help category).
What a PAT Is
- Tied to your account, not a blog. Unlike a blog's API key (which grants read-only access to one blog's published content), a PAT acts as you — it inherits whatever roles you hold across every blog you're a member of.
- Shown once. A PAT looks like
pnp_…and is hashed (SHA-256) before storage. Postnomic displays the value only at creation time; if you lose it, revoke it and create a new one. - Not a login credential. A PAT cannot sign you into the WebApp dashboard — it only authenticates API requests (directly, or through a tool such as the MCP server).
Minting a Token
- Sign in to the Postnomic dashboard.
- Open Access Tokens from the user menu.
- Click Create Token, give it a descriptive name (e.g., "Laptop — Claude Code" or "CI pipeline"), and confirm.
- Copy the
pnp_…value shown on screen — this is the only time it is displayed.
Create a separate token per machine, script, or agent so you can revoke one without affecting the others.
Revoking a Token
From the Access Tokens page, click Revoke next to any token. Revocation takes effect immediately — the next request made with that token is rejected. Revoke a token as soon as it is no longer needed, or if you suspect it has been exposed.
What PATs Are Used For
- Direct API access — Authenticate
curlscripts or custom integrations withAuthorization: Bearer pnp_…on endpoints that accept theJwtOrPatpolicy (such as Posts, Post Translations, Analytics, Blogs, Media). - MCP / agent access — The Postnomic MCP server forwards your PAT to the API unchanged, so an AI agent (Claude Code, claude.ai, or another MCP client) can manage your blogs and read your analytics exactly as if you had done it yourself. See the MCP Server category for connecting a local agent or the claude.ai connector.
Requirements
- MCP access requires a paid plan — a valid PAT on a Free-tier account is still rejected when connecting to the MCP server. Direct API access via PAT is not plan-restricted.