Legacy unscoped Personal Access Tokens Sunset on November 30, 2026
Storyblok is the first headless CMS that works for developers & marketers alike.
Storyblok adds a layer of security and control to personal access tokens (PATs), used to access the Management API and perform CRUD (create, read, update, delete) operations.
Whatâs changing
Personal access tokens for the Management API support granular scopes and space restrictions. Instead of granting the token access to every scope on every space you own, tokens now allow you to choose:
- Which scopes the token can use. For example, stories, assets, components, or webhooksâyou must select at least one.
- Which spaces the token can access. The default option is All spaces, but you can restrict access to specific spaces.
To make it easier to differentiate them from the legacy tokens, the new PATs are prefixed with sb_pat_.
To learn more about the available options, check the Access Tokens developer concept.
Why weâre making this change
Before this change, every personal access token had full read-write access to every space the user owned. That blanket access violates the principle of least privilege. For example, a token used by a single continuous integration pipeline to publish stories in one space could also delete components in every other space.
The same risk applies to the Storyblok MCP server, which lets AI assistants call the Management API using a personal access token.
A scoped token controls what a malfunctioning or prompt-injected model can do, even if itâs instructed to delete data. This complements the MCP serverâs own role parameter, which restricts operations at the connection level.
What you need to do
Existing legacy tokens continue to work until 30.11.2026, when Storyblok revokes them regardless of their set expiration dates.
Replace every legacy unscoped token in use before then.
New tokens must use the new creation flow. When your current tokens expire, or you need new ones, create them with explicit scopes and optional space restrictions.
Best practices
- Audit your existing personal access tokens and note where theyâre used.
- Apply the principle of least privilege to each replacement tokenâdefine the scopes and spaces the integration actually requires.
- Store tokens in environment variables, never in frontend code or version control.
- Set expiration dates and rotate tokens regularly.
Transition period
The new scoped tokensâprefixed with sb_pat_â became the default on 29.05.2026. As of that date, the legacy unscoped token creation flow is no longer available. Every new token must specify scopes and spaces, including Full user permissions (no scope/space restrictions).
Existing legacy tokens enter a six-month transition period:
- Until November 30, 2026, legacy unscoped tokens continue to function with their current (full) permissions. You can rename or revoke them, but not duplicate or recreate the old format.
- On November 30, 2026, Storyblok revokes all remaining legacy unscoped tokens. This hard cutoff applies regardless of each tokenâs expiration date.
To help you plan the migration, Storyblok will send emails and in-app reminders on the following dates:
- August 31, 2026 (90 days before)
- October 30, 2026 (30 days before)
- November 23, 2026 (7 days before)
