Personal access tokens

A personal access token (PAT) authenticates your own account without an OAuth flow. Use one for scripts, cron jobs, personal agents, or self-hosted tools that only you operate. If other people will connect their accounts to your software, use OAuth instead.

Creating one

At mouve.it/developers → API tokens:

1. Name the token (so you recognize it in the list later).
2. Pick its scopes — smallest set that does the job. Health-data scopes require the same explicit acknowledgement as an OAuth consent, and record a consent entry.
3. Pick an expiry: 30, 90 (default), or 365 days — or non-expiring for headless clients you commit to rotating yourself.
4. Copy the token. It is shown exactly once; Mouve stores only a hash.

Limits: up to 25 active tokens per account.

Format

mouve_pat_k9GmXw3vTqLpZr8dNs5cHbJf2yAeUo41xRiVE7wQzt9

mouve_pat_ + 41 base62 characters (35 random + 6 checksum), 51 characters total. The checksum lets tooling reject mistyped tokens without a network call. For secret scanners, the match pattern is:

\bmouve_pat_[0-9A-Za-z]{41}\b

Using it

curl https://api.mouve.it/public/v1/me \
  -H "Authorization: Bearer mouve_pat_..."

A PAT is subject to exactly the same scope enforcement, per-request revocation checks, and account-standing checks as an OAuth token — plus its own per-token rate limits.

Handling rules

• Treat it like a password: environment variables or a secret manager, never source control, never client-side code, never logs.
• One token per tool. When a machine or integration is retired, revoke its token — revocation takes effect on the next request.
• If a token leaks, revoke it at mouve.it/developers → API tokens immediately. The token list shows each token's last-used time and last 4 characters to help you identify it.