Profile & Settings

Your profile

Click your avatar in the top-right corner and select Profile to view and edit your account details.

You can update:

• First name and Last name

• Email address

• Timezone — Rockhopper auto-detects your browser timezone, but you can override it here. Timestamps throughout the app (versions, comments, change log entries) display in your chosen timezone.

• Avatar — Click your avatar image to upload a new photo. Images are resized to 256 x 256 pixels automatically. Maximum file size is 5 MB.

Click Save when you're done. The button is only enabled when you have unsaved changes.

Profile Settings page with avatar, name, email, and timezone fields

Access Tokens

Access Tokens let you connect external tools — like an AI assistant or the Postman workspace — to your Rockhopper account. Navigate to Avatar → Access Tokens or go directly to app.rockhopper.co/settings/access-tokens.

Creating a token

1. Click Create token

2. Give the token a descriptive name (e.g. "Cursor MCP", "Claude Desktop")

3. Choose a scope:

   • Read-only — the token can view files, versions, comments, and reviews but cannot make changes

   • Read-write — the token can also post comments, open review requests, approve reviews, and update file descriptions

4. Set an expiry — 30, 60, 90, 180, or 365 days

5. Click Create

The token value is shown only once. Copy it immediately — Rockhopper cannot retrieve it later. The clipboard auto-clears after 30 seconds for security.

Start with read-only scope. Only upgrade to read-write if you have a workflow that genuinely needs write access.

Managing tokens

Personal Access Tokens page showing active tokens

The Access Tokens page shows all your active tokens with:

Column	What it shows
Name	The label you gave the token
Token	A masked prefix (e.g. rh_pat_abc1...) — never the full value
Scope	read-only or read-write badge
Expires	When the token stops working
Last used	When the token was last used to call the API

Revoking a token

Click Revoke next to any token to disable it immediately. A confirmation dialog appears before the token is deleted. Revoked tokens cannot be restored — you'll need to create a new one.

Revoke a token if:

• You suspect it has been exposed or compromised

• The tool or integration it was created for is no longer in use

• You want to rotate tokens as a routine security practice

For web-based AI clients (Claude.ai, ChatGPT), you don't use a PAT — you sign in through Rockhopper's normal SSO flow. The gateway issues short-lived session tokens (~30 minutes) that auto-rotate. These sessions also appear on the Access Tokens page, prefixed with gateway:.