Tokens

Your build tools use Artifex with a personal access token instead of your password. You create a token on the Tokens page, and you decide there what it can access.

Create a token

To create a token, follow these steps:

1. Go to Tokens.
2. Click New token.
3. In the Name field, enter a name that tells you where the token is used, such as Laptop or CI.
4. In the Expires list, select 30 days, 90 days, 365 days, or No expiry.
5. For Access, select Read to download, or Write to download and publish.
6. For Repositories, select Every repository you can access, or select Only these repositories and then select the repositories.
7. Click Create token.

The token appears once, under Copy your token now. Copy it into the place that your tool reads it from, and then click Done. For Maven and Gradle examples, see Deploy artifacts.

What a token can access

A token can access only the repositories that you chose for it, and never more than you can access yourself. If you hold read access to a repository, a token with write access can only read there. If you lose access to a repository, your tokens lose it too.

A token can read or write. Settings, sharing, and upstreams are changed by a person in a browser, never by a token.

In a public repository, any token can read, because anyone can.

Change what a token can access

To change a token's access, follow these steps:

1. Go to Tokens.
2. In the token's row, click Edit access.
3. Change Access or Repositories.
4. Click Save access.

The change applies to the token's next request.

Revoke a token

To revoke a token, follow these steps:

1. Go to Tokens.
2. In the token's row, click Revoke.
3. Click Revoke to confirm.

The tools that use the token fail on their next request. Create a token for them and update their credentials. Tokens for every CodeSoh product are also listed, and can be revoked, in your CodeSoh account.

Tokens on the Access page

A repository's Access page lists every token that can access the repository under Tokens with access: the ones that name the repository, and the ones that cover every repository and belong to someone who has access. An administrator can remove a token that names the repository. A token that covers every repository loses its access when its owner does.

Advanced

Artifex accepts a token as the password of HTTP Basic authentication, with any user name, which is what Maven and Gradle send, and as a bearer token in an Authorization header. A revoked or expired token is treated as no credentials at all. A request from a token whose access doesn't cover the repository answers 403 Forbidden.