diff --git a/README.md b/README.md
index 759b91f..16e64b1 100644
--- a/README.md
+++ b/README.md
@@ -176,6 +176,30 @@ full annotated shape, and each submodule's `secrets.js.example`.
   `cn=admin,<base>` (admin) or `cn=ldapclient,ou=people,<base>` (read-only
   service account the bootstrap created). Use LDAPS, not plain LDAP.
 
+### API tokens (personal access tokens)
+
+Both apps support **self-service personal access tokens** for calling their
+management APIs from scripts/CI/other services without an OIDC browser session.
+Each logged-in user mints their own tokens under **API Tokens** in the UI
+(the raw token is shown once); a token authenticates **as its creator** and
+carries their permissions. Revoke or rotate from the same page (immediate
+effect). Tokens persist in Redis (AOF) and survive rebuilds.
+
+```bash
+# SSO Manager — manage users/groups/OAuth clients from a script
+curl -H "Authorization: Bearer sso_<id>_<secret>" https://<SSO_HOST>/api/user
+
+# Proxy — manage Host records from a script
+curl -H "Authorization: Bearer prx_<id>_<secret>" https://<PROXY_HOST>/api/host
+```
+
+Format is `<prefix>_<id>_<secret>`; the `id` is the lookup key, the `secret` is
+bcrypt-hashed and never stored in plaintext. In the proxy, the creator's group
+membership is snapshotted at mint time (revoke + re-mint to tighten after group
+changes); the SSO re-resolves groups from LDAP live on each call. See each
+submodule's DEPLOYMENT (`sso-manager-node/DEPLOYMENT.md`, `proxy/DEPLOYMENT.md`)
+for details.
+
 ---
 
 ## Logs
diff --git a/docs/index.md b/docs/index.md
index a97ab2b..e125f88 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -38,6 +38,11 @@ together, and [Standalone](standalone.html) for running each project on its own.
   with OIDC login.
 - **LDAPS** at `ldaps://<host>:636` — legacy apps can bind directly (admin or
   the read-only `cn=ldapclient` service account the bootstrap creates).
+- **API tokens** — both apps let any logged-in user mint self-service personal
+  access tokens (`Authorization: Bearer sso_…` / `prx_…`) to drive the management
+  API from scripts/CI without a browser session. A token authenticates as its
+  creator (carrying their permissions); mint/rotate/revoke under **API Tokens**
+  in each UI. See each submodule's DEPLOYMENT for the details.
 
 ## The `./config/` values you must set
 
diff --git a/docs/quickstart.md b/docs/quickstart.md
index cb9acf0..cc0734a 100644
--- a/docs/quickstart.md
+++ b/docs/quickstart.md
@@ -142,6 +142,10 @@ docker compose exec sso-manager slapcat -f /etc/openldap/slapd.conf \
 
 - Add users / groups in the SSO UI.
 - Add Host records in the proxy UI to protect your apps with OIDC.
+- **Mint API tokens** to drive either app's management API from scripts/CI:
+  under **API Tokens** in each UI, mint a personal access token and use it as
+  `Authorization: Bearer sso_…` (SSO) or `prx_…` (proxy). A token authenticates as
+  its creator with their permissions. See each submodule's DEPLOYMENT.
 - See [Architecture](architecture.html) for how it all fits together, and
   [Standalone](standalone.html) to run either project on its own.
 
diff --git a/proxy b/proxy
index 8e78604..a9a48c3 160000
--- a/proxy
+++ b/proxy
@@ -1 +1 @@
-Subproject commit 8e78604a37cc473de39ef0690aec471ddb514142
+Subproject commit a9a48c3445ff7280e7f3c543178a879c4b347e60
diff --git a/sso-manager-node b/sso-manager-node
index 6920a9f..b91ef27 160000
--- a/sso-manager-node
+++ b/sso-manager-node
@@ -1 +1 @@
-Subproject commit 6920a9f9f0c513142c3eef536b3985656a04f2cd
+Subproject commit b91ef2792dc9bddf56ecee4008a962d4d308ee4b