# Access tokens

[Open in the interactive reference](https://docs.api.lensing.ai/?op=guide%3Atokens)

Create access tokens in your tenant, under **API Hub › Connect › Access Tokens**. A new token can call nothing: open it and grant it access before you use it.

### Granting access

Access is granted per operation, or broadly for an area of the API, which also covers operations added to that area later. A token that can read a collection may not be able to write to it, and deleting is usually a grant of its own.

A change to a token's grants can take a few minutes to reach a token that is already in use. When a `403` is unexpected, check the token's grants before you change the request.

### Production and sandboxes

A token is bound when you create it, and the binding does not follow the sandbox you happen to be in. It is bound to production, your live data, unless you tick **Restrict this token to a sandbox** and choose the sandbox yourself. It reads and writes only the data it is bound to. The token list shows a production token's scope as **Main**.

A sandbox token can be moved to another sandbox, and stops working in the one it leaves. It can never be moved to production, and a production token can never be moved into a sandbox. When its sandbox is closed or inconsistent, a sandbox token stops working.

### Expiry, renewal and revocation

Every token created on the Access Tokens page has an expiry date. Its value is shown only once, when the token is created or renewed, so store it in a secret store straight away.

Renewing a token replaces it. The replacement has a new value and the same access and binding, and the original is revoked at once, with no overlap. To change credentials without an interruption, create a second token where you created the first, grant it the same access, switch the integration over, and then revoke the first.

A revoked token is refused from the next request on. For a few minutes after revocation, that refusal can be a `500` rather than a `401`.

### Personal access tokens

A personal access token also works, and is convenient for testing. It acts as you: it can do only what both its grants and your own permissions allow.