diff --git a/app/controllers/profiles/personal_access_tokens_controller.rb b/app/controllers/profiles/personal_access_tokens_controller.rb
index 5a6026f58cb440f4c2a7bb9d2a9f61ac5c73a9aa..7fbf343edbdd207afa4f21f46e0af985b6ad11b5 100644
--- a/app/controllers/profiles/personal_access_tokens_controller.rb
+++ b/app/controllers/profiles/personal_access_tokens_controller.rb
@@ -32,6 +32,8 @@ class Profiles::PersonalAccessTokensController < Profiles::ApplicationController
   private
 
   def personal_access_token_params
-    params.require(:personal_access_token).permit(:name, :expires_at)
+    # We aren't using `personal_access_token` as the root param because the authentication
+    # system expects to find a token string there - it's off-limits to us.
+    params.require(:personal_access_token_params).permit(:name, :expires_at)
   end
 end
diff --git a/app/views/profiles/personal_access_tokens/index.html.haml b/app/views/profiles/personal_access_tokens/index.html.haml
index 77726d34fbc8aac56b48f84a53829ae967578930..72e67df4337dff096ac262633efe76bc073d63cc 100644
--- a/app/views/profiles/personal_access_tokens/index.html.haml
+++ b/app/views/profiles/personal_access_tokens/index.html.haml
@@ -12,7 +12,8 @@
       Add a Personal Access Token
     %p.profile-settings-content
       Pick a name for the application, and we'll give you a unique token.
-    = form_for [:profile, @personal_access_token], method: :post, html: { class: 'js-requires-input' } do |f|
+    = form_for [:profile, @personal_access_token], as: "personal_access_token_params",
+                method: :post, html: { class: 'js-requires-input' } do |f|
 
       .form-group
         = f.label :name, class: 'label-light'