Access tokens

Manage tokens in Settings > Access tokens. Token creation must be enabled for your organization.

Personal access tokens

Personal access tokens act on your behalf for a limited time. Their grants limit which repositories and VMs they can access, and at what level.

Use the avr CLI to create a token. Sign in, then replace my-org and owner/repo with your organization slug and repository:

avr auth login
avr token create --org my-org --name ci-reader --repo owner/repo --ttl 8h
avr token create --help

The console lists your live tokens. Eligible organization administrators can also see and revoke other members' tokens. Revoking a token stops new requests; credentials it already obtained, such as a Git token or VM password, remain valid until they expire or are rotated.

Service tokens

Service tokens belong to a group rather than a person. Use them for automation that reads repository information, SBOMs or firewall rules. They continue working when their creator leaves the organization.

Administrators with token-management permission can create a service token in Settings > Access tokens:

1. Choose a name and an owning group.
2. Add repositories or firewall rules to its read access. You can select individual repositories, individual firewall rules, or all firewall rules. You can only grant access that you hold yourself.
3. Choose a secret lifetime, then create the token.
4. Copy the secret and store it securely. It is shown only once.

Never expires: This secret does not expire. Anyone with it can use its allowed access. Revoke it if exposed.

Suspending the owning group stops the token's access. The group cannot be deleted until its tokens are revoked or expired.

Change access

Choose Edit access to add or remove grants. Changes apply on the next request. If service-token creation or resource access is disabled, you can still remove access and revoke existing tokens.

Rotate a secret

Choose Rotate to replace a lost secret or update your automation's credentials. Select a lifetime for the new secret and an overlap period for the current secret. The current secret works during that overlap, but never past its own expiry or the new secret's. Update your automation before the overlap ends.

Rotating again during an overlap immediately stops the oldest secret. The console warns before you do this.

Revoke tokens

Choose Revoke to stop a token and its overlapping secrets. For a suspected leak affecting several tokens, open the ⋯ menu of the service token list, choose Revoke all service tokens and confirm with your organization's slug. Revocation cannot be undone.