You may optionally allow the account to post to any channel in your Mattermost server, including direct messages by choosing the post:all role. post:channels role allows the account to post to any public channel in the Mattermost server.
Then select Save.
Sign in to the user account to create a personal access token.
Go to Account Settings > Security > Personal Access Tokens, then select Create New Token.
Enter a description for the token, so you remember what it’s used for. Then select Save.
Note: If you create a personal access token for a System Admin account, be extra careful who you share it with. The token enables a user to have full access to the account, including System Admin privileges. It’s recommended to create a personal access token for non-admin accounts.
A personal access token can be revoked by deleting the token from either the user’s account settings or from the System Console. Once deleted, all sessions using the token are deleted, and any attempts to use the token to interact with the Mattermost server are blocked.
Tokens can also be temporarily deactivated from the user’s account settings. Once deactivated, all sessions using the token are deleted, and any attempts to use the token to interact with the Mattermost server are blocked. However, the token can be reactivated at any time.
Besides the above differences, personal access tokens are exactly the same as regular session tokens. They are cryptic random IDs and are not different from a user’s regular session token created after logging in to Mattermost.
Not in Mattermost, but you can automate your integration to cycle its token through the REST API.
The best option is to go to System Console > Logs and finding error messages relating to a particular token ID. Once identified, you can search which user account the token ID belongs to in System Console > Users and revoke it through the Manage Tokens dropdown option.
No. The session used by the personal access token is revoked immediately after a user is deactivated, and a new session won’t be created. The tokens are preserved and continue to function if the user account is re-activated. This is useful when a bot account is temporarily deactivated for troubleshooting, for instance.