Skip to main content

API tokens

API tokens authenticate machines: CI pipelines uploading test reports, and anything else calling the ingestion API.

Administration → API Tokens. Owners and admins only.

Creating one​

Give it a name that says which machine or pipeline will hold it, and optionally an expiry. The token is displayed once. Copy it immediately.

Each token carries the organization it was made in — that is what scopes every request made with it, and why the CLI needs no organization argument.

Using one​

Send it as the x-api-token header, or set SEKEE_API_TOKEN and let sekee-cli do it.

export SEKEE_API_TOKEN="…"

In CI, store it as a secret. A token in a committed pipeline file is a token that has to be rotated.

What a token can do​

CI tokens are for ingestion only: creating automation runs, appending threads to them, sending visual snapshots to them, and completing them. They are not a general-purpose API key and cannot read your test library or write to it.

Sending snapshots is ingestion too. Sekee compares them as they arrive and the upload's own answer carries the results, so CI never needs to read anything back. A CI token cannot list snapshots, open a review, or approve or reject a change; that is done by a person on the Visual Testing page.

:::note Recently changed The list above gained visual snapshots. What a CI token can reach otherwise is unchanged: it still reads nothing. :::

:::info Not the same thing as an AI connector token AI connector tokens are a different kind of credential, stored in the same table underneath but never shown on this page. This list is CI tokens only — a token with no user attached. A connector token belongs to a user, acts as that user, and is managed only by that user under Settings → AI Connector. :::

:::note Recently changed This page, and an admin or owner generally, used to be able to see and revoke anyone's AI connector token. It now shows and touches CI tokens exclusively: findOne, update and delete on a connector token answer 404, the same as if the row did not exist, whoever is asking. Nobody but the person who created a connector can see it or revoke it — not an owner, not an admin. Two different people may name theirs the same thing; the clash check that used to stop that was scoped to the whole organization and is now scoped to one person. Removing or blocking a member ends their connectors immediately, without deleting the rows: a blocked or removed user's token simply stops authenticating. :::

Rotating and revoking​

Deactivating a token, or deleting it, takes effect immediately. Rotate by creating the new token, updating the secret in your pipeline, confirming a run lands, then revoking the old one — in that order, so there is never a window where CI cannot report.

The list shows each token's name and description, whether it is active, when it expires, and when it was last used. The token itself is never shown again after it is created. A token that has never been used is either a rotation somebody forgot to finish or a leak worth thinking about.