User Access Tokens

User Access Tokens

User access tokens are long-lived API tokens for authenticating with App Maker from outside the web UI — the App Maker CLI, CI pipelines, or direct API calls. They complement SSH public keys: the SSH key grants git access to project repositories, while the access token authenticates platform API operations.

Creating a Token

1. Open your account menu and go to User Access Tokens.
2. Click Create.
3. Fill in:

   • Name — a label identifying where the token will be used (e.g. ci-pipeline, laptop-cli).
   • Lifetime — how long the token stays valid: one week, one month, three months, six months, or one year.
   • Privileges — the permission scopes granted to the token. Grant only what the consumer needs; a CI token that only triggers builds does not need user-management privileges.
4. Confirm. The token value is displayed once — copy it immediately and store it in a secret manager. It cannot be retrieved again later.

Managing Tokens

The token list shows each token's name, creation date, and expiry. Tokens cannot be edited — to change lifetime or privileges, create a new token and revoke the old one.

• Revoke — delete a token to invalidate it immediately. Any CLI or CI job using it will start receiving authentication errors.
• Expiry — tokens expire automatically at the end of their lifetime; rotate tokens used in CI before their expiry date.

Using a Token with the CLI

The App Maker CLI uses the token to authenticate platform operations. See the AppMaker CLI documentation for the login/configuration command, and Setup Existing Project on CLI for the full local setup flow.

Security Notes

• Treat tokens like passwords: never commit them to a repository or paste them into shared documents.
• Prefer short lifetimes and narrow privileges; create separate tokens per consumer so one can be revoked without breaking the others.