Use a **personal access token (PAT)** for server-to-server integrations. Create and revoke tokens in the [production portal](https://app.ripscloud.com/settings/tokens). The portal uses phone sign-in with WhatsApp OTP.

## Send the token

```http
Authorization: Bearer rc_pat_REPLACE_WITH_YOUR_SECRET
Accept: application/json
```

The value above is a placeholder. A PAT is an opaque secret, not a JWT. Do not decode it or send it to SISPRO or PahFacturar. RipsCloud manages those connections.

## Select permissions

| Scope   | Allows                             | Example                                   |
| ------- | ---------------------------------- | ----------------------------------------- |
| `read`  | Read authorized resources          | List packages and read dispatch attempts  |
| `write` | Change authorized resources        | Save a draft, create a revision, validate |
| `send`  | Request supported external actions | Dispatch RIPS or emit a health document   |

Scopes do not include one another. A complete RIPS flow usually needs **read + write + send**. Give a read-only integration only `read`.

Each request also checks the user's active membership and role. A token cannot give a user more access than their current account. Each token selects its workspaces and expires after the configured lifetime, from 1 to 365 days.

## Keep administration in the portal

Token creation and revocation require an interactive session. A PAT cannot create another PAT. Workspace administration and upstream credentials also require the appropriate interactive role; they are excluded from this integration reference.

Use a separate token for each integration and environment. Revoke unused tokens. After revocation, expiry, removal of membership, or account deactivation, access can stop even if the secret has not changed.

## Resolve access errors

- `401`: verify the host and token. Check expiry and revocation. Obtain a new token through the portal if needed.
- `403 personal_access_token_scope_required`: add the required scope through a replacement token.
- `403 personal_access_token_workspace_forbidden`: use a workspace selected for that token.
- `403 workspace_membership_required`: check the user's current membership with the workspace administrator.
- `personal_access_token_not_allowed`: the operation requires an interactive session. Use the portal.

Never include a PAT in a support message. Share the HTTP status, `error.code`, and `requestId` instead.