Manage personal access tokens🔗

Lightrun personal access tokens (PATs) provide a secure, reusable way to authenticate an MCP client as your Lightrun user without an interactive browser sign-in. A PAT preserves your current role-based permissions and Agent Pool access, so the MCP client can perform only the actions that you are authorized to perform.

Before you begin🔗

Ensure that:

• Role-Based Access Control (RBAC) is enabled for your organization.
• Your role includes access to Lightrun MCP.
• A Company Admin has enabled MCP access in Service Configuration.
• You know your deployment's MCP endpoint URL. SaaS users connect to https://app.lightrun.com/mcp. For Single-Tenant and On-Premises deployments, find the URL under Platform > Lightrun MCP in the Management Portal.

Personal access tokens and system API keys🔗

PATs and system API keys both use a Bearer token, but they represent different identities and use cases.

Changes to your role or Agent Pool assignments take effect immediately for existing PATs. A PAT never grants permissions beyond those assigned to its owner.

Generate a personal access token🔗

1. Log in to the Lightrun Management Portal.
2. Click Settings in the upper-right corner.

3. Under Security, select Personal Access Tokens.

   The Personal Access Tokens page opens. Depending on your role, the table displays your tokens or all tokens in the organization.

4. Click Generate PAT.

   The Generate PAT panel opens.

5. In Token label, enter a label that identifies the client or device that will use the token.

   A label is optional. If you leave it blank, Lightrun assigns a label based on the token's last three characters.

6. Under Expiration period, select 30 days, 60 days, 90 days, or Custom. The default is 90 days.

   For a custom expiration, select a date from tomorrow through two years from the current date.

7. Click Generate.

   Lightrun generates the PAT and displays it once.

8. Copy the token and store it in a secure secret manager.

Connect to Lightrun MCP with a PAT🔗

Configure your MCP client to send the PAT in the HTTP Authorization header:

Authorization: Bearer <PERSONAL_ACCESS_TOKEN>

For clients that use an mcp.json configuration file, add the MCP endpoint and header:

"Lightrun": {
  "url": "https://your-lightrun-server-domain/mcp",
  "headers": {
    "Authorization": "Bearer <PERSONAL_ACCESS_TOKEN>"
  }
}

Replace the URL when your deployment does not use Lightrun SaaS. Replace <PERSONAL_ACCESS_TOKEN> with the value that starts with lr_pat_.

For client-specific connection instructions and an initial MCP test, see the Lightrun MCP quickstart.

Edit a token label🔗

You can change a token's label without changing its value or expiration date:

1. On the Personal Access Tokens page, select the token.
2. In the Token panel, update Token label.
3. Click Save.

Revoke and delete a personal access token🔗

Revoke a PAT immediately when it is exposed, no longer required, or belongs to a client that should no longer connect.

1. On the Personal Access Tokens page, click Revoke and Delete for the token.

2. In the confirmation dialog, click Revoke and delete.

   Lightrun immediately rejects subsequent authentication attempts with the token. This action cannot be undone.

PAT management permissions🔗

Users can generate PATs only for themselves. Visibility and management of existing PATs depend on the user's role:

Regardless of who can view or manage a PAT, MCP actions always use the current permissions and Agent Pool access of the token owner.