[Devon-White]

Summary

New personal access tokens start with swpat_. Tokens with the older pat_ prefix still work. The issue's swpa is the first four characters of that prefix.

Source: prime-rails PR #10497, merged 2026-10-13.

• app/services/token_format.rb builds the new prefix.
• personal_access_token/operations/create.rb uses that format.
• personal_access_token_authentication.rb accepts both prefixes.

Changes

• specs/_shared/auth.tsp: the token description and example header.
• fern/products/apis/pages/core/authorization.mdx:
  • The prefix sentence.
  • The header and cURL examples.
  • The "Where it's accepted" bullet.
• fern/products/platform/pages/platform/core/glossary.mdx: the Personal access token entry.

Not changed

• Cut-over date. The date the new format reached customers isn't verifiable from source, so it isn't stated.
• job_title: "" on members. This is the issue's second point, and nothing here changes it.

Questions for reviewers

1. Should this get a changelog entry, like the 2026-09-14 swapi_ one? It needs the date the new format went live.
2. Should the docs state the 42-character token length? The swapi_ docs state theirs.
3. Who picks up the job_title point?

Verification

• yarn build:specs passes.
• yarn fern-md-check passes.
• The #personal-access-tokens anchors are unchanged.

Closes #851

[github-actions]

🌿 Preview

https://signalwire-preview-docs-860.docs.buildwithfern.com/docs

---

View workflow run

[Manny-r31]

Review verdict: Ready to merge

Checked against prime-rails main (775a2b5). CI passes; auth.tsp, openapi.yaml and the MDX wording agree, and there are no other stale pat_ mentions in the docs.

Verified:

• New PATs are swpat_: app/services/token_format.rb (ORG_ID = "sw", TYPE_PAT = "pat", prefix "#{ORG_ID}#{type}_"), generated in personal_access_token/operations/create.rb.
• Legacy pat_ still authenticates (models/personal_access_token.rb:6 LEGACY_TOKEN_PREFIX, checked in concerns/personal_access_token_authentication.rb); legacy tokens skip the checksum.
• Basic auth with the token as password only; Bearer is not used for PATs.
• Your question 2: stating the length is accurate. 6-char prefix + SECRET_LENGTH 30 + CHECKSUM_LENGTH 6 = 42 characters.

Optional:

1. A swpat_ token with a bad checksum is rejected before any lookup (TokenFormat::VerifyChecksum). One line in authorization.mdx (~L102) would explain why a mistyped token gets a 401.

Your questions 1 (changelog entry) and 3 (job_title) can't be settled from source; leaving those to you.

[Devon-White]

@Manny-r31 thanks for the review. Every item is addressed:

1. Mistyped swpat_ token gets a 401 (optional): added in 925c3c1. The Authorization page now says a swpat_ token includes a checksum, so a mistyped or altered token is rejected with 401 Unauthorized.

On the open questions from the PR description:

• Q2, token length: added in 59c6e3b. The page now says a swpat_ token is 42 characters long: a 6-character prefix, a 30-character secret and a 6-character checksum. That matches how the swapi_ format is described on the API credentials page.
• Q1, changelog entry: not part of this PR. The date the new format reached customers can't be confirmed from source, and changelog entries are dated by when a change shipped. Product can add one if they have the date.
• Q3, job_title: this PR doesn't change it, and it still needs an owner.

The branch also merges current main. Checks run: yarn build:specs (generated output unchanged by the merge) and yarn fern-md-check (all MDX valid).