Tokens

A personal access token is a credential that build tools use instead of your account password. You create one on the Tokens page, where you choose its token access level and the repositories that it can access.

Create a token

To create a token, follow these steps:

1. Go to Tokens.

2. Click New token.

3. In the Name field, enter a name that tells you where the token is used, such as Laptop or CI.

4. In the Expires list, select 30 days, 90 days, 365 days, or No expiry.

5. For Access, select Read to download, Write to download and publish, or Manage to also change settings, upstreams, domains, and sharing through the API.

6. For Repositories, select Every repository you can access, or select Only these repositories and then select the repositories.

   New token

   Learn more

   The token is shown once, right after it is created.

   Name *

   Expires

   Access *

   ReadDownload from the repositories it covers.

   WriteDownload and publish.

   ManageDownload, publish, and change settings, upstreams, domains, and sharing.

   Repositories *

   Every repository you can access

   Only these repositories

   alex/libs

   alex/plugins

7. Click Create token.

The token appears once, under Copy your token now. Copy it into your tool's credentials configuration, and then click Done.

Copy your token now

This is the only time the token is shown. Store it where your tool reads it from.

Personal access token

cs_pat_EXAMPLEs8Kq2mN4pR7tV9wX1yZ3aB5cD6eF8gH

For Maven and Gradle examples, see Deploy artifacts.

What a token can access

A token can access only the repositories that you chose for it, and it never receives a higher repository role than you have. If you have the Read repository role, a token with the Write token access level can only read there. If you lose access to a repository, your tokens lose it too.

A token with the Read or Write token access level can't change settings, sharing, or upstreams. A token with the Manage token access level can make those changes through the API in the repositories that it covers.

Any token can read a public repository.

Change a token's access

To change a token's access, follow these steps:

1. Go to Tokens.
2. In the token's row, click Edit access.
3. Change Access or Repositories.
4. Click Save access.

The change applies to the token's next request.

Revoke a token

To revoke a token, follow these steps:

1. Go to Tokens.
2. In the token's row, click Revoke.
3. Click Revoke to confirm.

Tools that use the token fail authentication on their next request. Create a token for them and update their credentials. Tokens for every CodeSoh product are also listed, and can be revoked, in your CodeSoh account.

Advanced

Artifex accepts a token as the password in HTTP Basic authentication, with any username, which is what Maven and Gradle send. The API also accepts the token as a bearer token in an Authorization header. A revoked or expired token is treated as an anonymous request. A request from a token whose access doesn't cover the repository responds 403 Forbidden.