# Airtable personal access tokens (/integrations/airtable-service-account)

Use an Airtable personal access token (PAT) to connect with explicit scopes and base access. The token can only perform actions allowed by both its scopes and its owner's Airtable permissions.

On Airtable Enterprise Scale plans, admins can create the same tokens from a dedicated **service account** in the Admin Panel. Those tokens are wire-identical to personal access tokens and are the better choice for organization-level use: they can continue working when an employee leaves, provided the service account retains its access.

## Prerequisites \[#prerequisites]

In Sim, you need workspace write access and permission to manage integrations.

Any Airtable user can create a personal access token for the bases they have access to. Keep in mind the token is capped by its creator's own permissions — a PAT created by a read-only collaborator cannot write, no matter which scopes it has. Create the token from an account with the access level your workflows need.

For service-account tokens, you need an Enterprise Scale plan and an admin with access to the Admin Panel.

## Creating the token \[#creating-the-token]

Open [airtable.com/create/tokens](https://airtable.com/create/tokens) and click **Create token**

Give the token a name (e.g. `sim-airtable-bot`)

Add the scopes your workflows need. The full set Sim's Airtable tools and triggers use is:

```
data.records:read
data.records:write
schema.bases:read
user.email:read
webhook:manage
```

Reading records needs `data.records:read`; creating, updating, upserting, and deleting records need `data.records:write`; listing bases and tables and reading base schemas need `schema.bases:read`; `user.email:read` lets Sim show the token owner's email as the credential name; and `webhook:manage` is only needed if you use Airtable triggers in Sim.

Under **Access**, add the bases or entire workspaces the token should reach. The token can only see what you list here — a token with all five scopes but no base access can't read anything.

Click **Create token** and copy it when it's shown. Airtable only displays it once — if you close the dialog, you'll have to regenerate it.

Warning:

The token grants access to the bases you authorize. Treat it like a password — do not commit it to source control or share it publicly. Sim encrypts the token at rest.

### Enterprise Scale: service account tokens \[#enterprise-scale-service-account-tokens]

On Enterprise Scale plans, create the service account in the **Admin Panel**, then create its token from **Personal access tokens**. Choose scopes and base access as above and paste the resulting token into the same field in Sim. The token belongs to the service account; keep that account's access in place when managing team membership.

Enterprise organizations can enable "Block API access to organization-owned bases and workspaces". If your organization uses this setting, the service account must be allowlisted or every call fails despite a valid token.

## Adding the personal access token to Sim \[#adding-the-personal-access-token-to-sim]

Open **Integrations** from your workspace sidebar

Search for "Airtable" and open it, then click **Add to Sim** and choose **Add personal access token**

Paste the **Personal access token**, and optionally set a display name and description

Click **Add personal access token**. Sim verifies the token by calling Airtable's `whoami` endpoint — if it fails, you'll see a specific error explaining what went wrong.

Warning:

Validation only proves the token is real — Airtable doesn't expose a PAT's scopes or base access for inspection. A token that validates fine can still fail every tool call if you skipped a scope or forgot to grant base access. If a block returns a 403 (`INVALID_PERMISSIONS`) or an unexpected 404 (`NOT_FOUND`), check the token's scopes and base access first.

## Using the credential in workflows \[#using-the-credential-in-workflows]

Add an Airtable block to your workflow. In the credential dropdown, select the saved Airtable personal access token. Choose the operation and configure its inputs.
Run a read operation against a base you granted to the token. If your workflow writes records or uses triggers, test those operations too; successful connection validation does not check all required scopes or base access.

## Rotate or revoke the token \[#rotate-or-revoke-the-token]

Airtable PATs remain active until deleted or regenerated, but their access also depends on the owner's current base and workspace permissions. A service-account PAT belongs to that service account; keep its grants in place.

Create a replacement with the same scopes and resource access, update the saved credential in Sim, and run a read and any required write or trigger operation. Delete the old token after those checks pass. Regenerating an existing token invalidates its old value immediately.

See Airtable's [personal access token guide](https://support.airtable.com/docs/airtable-api-key-deprecation-notice) and [service-account setup](https://support.airtable.com/articles/7043107100-service-accounts-overview).