How do I authenticate to Visual Studio Team Services and Team Foundation Server with a Personal Access Token?

Question

From PowerShell, how do I use Personal Access Tokens (PAT) to authenticate to my Visual Studio Team Services (VSTS) account or on-premises Team Foundation Server (TFS)?

Answer 1

As of July 2015, Visual Studio Online allows users to create Personal Access Tokens (PAT) as a more secure option than alternate credentials.

To authenticate to the REST APIs, all you need to do is use the PAT as the password portion in a Basic Auth HTTP Header along with your REST request.

$personalAccessToken = "your-personal-access-token-here"
$uri = "https://your-account.visualstudio.com/DefaultCollection/_apis/wit/workitems?api-version=1.0&ids=1,2,3,4"

Invoke-RestMethod `
-Uri $uri `
-Headers @{Authorization = 'Basic ' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($personalAccessToken)")) } 

Note, that the username portion of the Basic Auth header is completely ignored when you use a personal access token. You could have ("BLAHBLAH:$($personalAccessToken)")) instead and it will still work fine.