---
title: API Tokens
description: Create and manage Capawesome Cloud API tokens to authenticate the CLI in CI/CD pipelines and automate your workflows.
---

# API Tokens

API tokens authenticate the [CLI](../cli/index.md) and the [Cloud API](../api.md) without an interactive login — they're how you run Capawesome Cloud commands in CI/CD pipelines and scripts, where there's nobody to log in by hand.

A token acts on behalf of the account that created it, so it can do whatever you can do across the organizations and apps you have access to. Treat it like a password: anyone holding the token can act as you.

## Create a token

Create a token in the [Capawesome Cloud Console](https://console.cloud.capawesome.io){:target="_blank"} from your account settings. The token is shown **only once**, so copy it immediately and store it somewhere safe — if you lose it, you'll need to create a new one rather than retrieve the old.

## Use a token

You can use a token two ways.

With the **CLI**, store the token as a secret in your CI provider and pass it with `--token`:

```bash
npx @capawesome/cli login --token "$CAPAWESOME_TOKEN"
```

With the **Cloud API**, send it as a bearer token in the `Authorization` header:

```bash
curl https://api.cloud.capawesome.io/v1/apps \
  -H "Authorization: Bearer $CAPAWESOME_TOKEN"
```

See [CLI Authentication](../cli/authentication.md) and the [Cloud API](../api.md) for more.

!!! info

    If an organization uses [network restrictions](../organizations/network-restrictions.md), tokens are subject to them too. A pipeline running on a hosted CI runner will be blocked unless the runner's egress ranges are allowlisted.

!!! warning "Keep tokens secret"

    Never commit a token to version control or hard-code it. Always read it from a secret or environment variable, and revoke any token that may have been exposed.

## Revoke a token

Revoke a token at any time from the Console. Once revoked, it can no longer authenticate, and any pipeline still using it will start failing — so update your secrets when you rotate.

## Best practices

- **Use a separate token per pipeline or integration.** If one leaks or needs revoking, you only break that one place instead of everything at once.
- **Rotate periodically.** Replace long-lived tokens on a schedule, and immediately if you suspect one was exposed.
- **Store it as a secret, never in plain text.** Use your CI provider's secret store or a secrets manager, not a committed file or environment dump.