Personal access tokens
A personal access token (sometimes called an API key) lets your own tools reach your Kombine data through the API: a script, a shell alias, an AI agent like Claude Code, an importer from Jira. You decide what each token can touch and how long it lives, and you can revoke it at any time.
Tokens are for your own tools. Don’t paste one into a third-party service you don’t control.
Create a token
Section titled “Create a token”Tokens are created in the web app. You need an account with a verified email.
- At app.kombine.dev go to Settings › Account and find Personal access tokens.
- Click New token.
- Give it a Name (what it’s for, e.g. “Jira import”), and an optional Description.
- Pick when it Expires in: 7, 30, 90 or 365 days. 30 is the default. Tokens always expire.
- Set Permissions (see below). Give it only what the tool needs.
- Enter your Current password and click Create token.
- Copy your token now. It starts with
kmb_pat_and is shown only once. Kombine stores just a fingerprint of it, so it can’t show it again. Lost it? Revoke it and create a new one.
You can have up to 10 active tokens.
Permissions
Section titled “Permissions”Each token gets one level per area: None, Read, or Read & write. A token with everything set to None can’t do anything.
| Area | What it covers | Levels |
|---|---|---|
| tasks | Tasks, including imported ones | Read / Read & write |
| goals | Goals for each period, and period notes | Read / Read & write |
| sessions | Focus sessions, log entries and activities | Read / Read & write |
| timer | The live timer and timer settings | Read / Read & write |
| stats | Statistics and daily summaries | Read |
Some things are never reachable with a token, whatever its permissions: signing in, your password and account, devices, app settings and sync. A token can’t change your password or delete your account.
Reading an area is any GET. Everything else (creating, changing, deleting) needs Read & write.
See and revoke tokens
Section titled “See and revoke tokens”Go to Settings › Account › Personal Access Tokens to see your tokens and Revoke one. You can’t create tokens in the app; use the web app for that.
Go to Settings › Account › Personal Access Tokens to see your tokens and Revoke one. You can’t create tokens in the app; use the web app for that.
Settings › Account › Personal access tokens lists every token with its permissions, when it expires, when it was created and when it was last used. Click Revoke on one, or Revoke all.
Revoking works instantly: the next request with that token fails.
Signing out, signing out everywhere and changing or resetting your password don’t revoke tokens. Only revoking, expiry or deleting your account do. If you think a token leaked, revoke it.
Keep tokens safe
Section titled “Keep tokens safe”- Treat a token like a password. Keep it in an environment variable or your password manager, never in code you commit.
- One token per tool. Then revoking one doesn’t break the others, and last used tells you which tool is active.
- Short expiry for experiments, longer for tools you rely on.