API tokens

A token lets a script, a CI pipeline or an agent act as you without a browser. Manage yours in Settings > API tokens.

Create a token

1. Select Create token.
2. Give it a Name and a Purpose, so you can recognise it later.
3. Tick the Scopes it needs.
4. Optionally add Destinations: an account handle, or handle/project, comma separated. The token can then act only there.
5. Select Create token, copy the value, then choose I have saved this token.

The value is shown once. Deftro never shows it again, so if you lose it, make a new one.

GitHub and payment gateways do not use tokens: they sign each request instead. A few actions accept requests from the site itself only and refuse every token, such as the help assistant's question log.

Scopes

• read: list and fetch what your account can see.
• install: record installs, and your own public acts: stars, votes, discussion and community posts, following or saving a thread, following a person or organisation, marking the answer on your own thread, and reports.
• publish: create artifacts and publish versions.
• manage: organisation settings, members and projects, and claiming a listing of your skill.

A scope is a limit, not a grant. A token can never do more than you can: with manage, a viewer is still refused. Scopes do not include each other, so publish does not bring install.

Some actions refuse every token and need you in a signed-in browser, such as Review decisions, Import from GitHub and everything in the Sponsor area (bids, funds, applying to advertise). See Signing in.

Expiry, revoking and regenerating

Tokens you create here do not expire on their own. Each row shows when the token was created and last used, and by which client. A warning appears when a token has gone unused for a long while, or when different clients use it.

• Revoke cuts the token off at once. Anything using it loses access.
• Regenerate revokes the old value and gives you a new one with the same scopes and destinations. Copy it straight away.

Asking to delete your account revokes all of your tokens at once. If you cancel by signing in within 14 days, you need to create new ones.

CLI and extension tokens

When you run deftro login, or sign in from the browser extension, you approve a short code in your browser. The code stays valid for 10 minutes. That creates a token for that device. The CLI's token lasts until you revoke it. The extension's lasts 90 days, then you sign in again. Both also appear under Connected devices in Settings, where Revoke signs that device out.