# Personal access tokens and self-service account settings

*Tableau Server Administrator Study Guide · Administration · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-server-administrator/administration/personal-access-tokens-and-self-service-account-settings*

How Tableau Server personal access tokens work for REST automation (who creates and revokes them, one session per token, owner privileges, expiry, server administrator impersonation) and which account changes users make themselves in My Account Settings, including passwords and saved credentials.

- Certification: Salesforce Tableau Server Administrator
- Exam section: Administration
- Study guide: https://www.certifyforce.com/study-guide/tableau-server-administrator

**Official exam objective:**

> 3.3 Contrast end-user with System-administrator capabilities

## What the exam expects

- Explain who creates, manages and revokes a personal access token, and what an administrator can and cannot do with another user's token.
- Predict what happens when one token signs in twice, and what privileges a token-based session carries.
- List the prerequisites for server administrator PAT impersonation on Tableau Server 2022.3.
- Decide which account changes a user makes in My Account Settings (password, saved credentials, connected clients) and which belong to the directory or an administrator.

Key terms:
- **Personal access token (PAT):** a long-lived token, made of a name and a secret, used to sign in to the Tableau REST API without a username and password.
- **PAT impersonation:** using a server administrator's PAT to sign in to the REST API as another user.
- **My Account Settings:** the page each user opens from their profile image to manage their own credentials and preferences.
- **Saved credentials:** passwords and OAuth access tokens Tableau stores for a user's data connections.
- **Connected client:** a refresh token stored when a user first signs in from Tableau Desktop, Prep Builder or Mobile.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| PAT creation | Users create their own; administrators cannot create PATs for users | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Secret visibility | Shown once, then inaccessible after the dialog is dismissed | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Concurrent sign-in | Reusing a PAT ends its previous session, on any site | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Session privileges | Same access and privileges as the PAT owner | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Not for | Generic client access to the web UI or TSM | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Admin revocation | Server or site admin, user profile > Settings tab > Revoke | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Password resets | Don't disrupt PAT-based automation | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Impersonation | 2021.1 and later; server admin PATs; `tsm authentication pat-impersonation enable` then apply | [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm) |
| Change Password in account settings | Local Authentication only, not Active Directory | [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm) |
| Deleting an embedded OAuth token | Scheduled extract refreshes fail until new credentials are embedded | [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm) |
| TSM sign-in | Needs administrative rights on the computer running TSM | [Sign in to TSM Web UI](https://help.tableau.com/current/server/en-us/sign_in_tsm.htm) |

## Check yourself

- How many PATs can one Tableau Server user hold by default?
- When can Tableau Server users on a site with site-specific SAML change their own email address?
- Why must users recreate notification settings after upgrading from 2020.4 or earlier to 2021.1 or later?
- What happens to an expired PAT on the My Account Settings page?

## Sources

- [Personal Access Tokens](https://help.tableau.com/current/server/en-us/security_personal_access_tokens.htm)
- [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm)
- [Sign in to Tableau Services Manager Web UI](https://help.tableau.com/current/server/en-us/sign_in_tsm.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Tableau Server Administrator pack (USD $19): https://www.certifyforce.com/practice-exams