Create an access token

Generate a scoped token for CI systems and the ShipStack CLI.

You'll create an access token to authenticate your CI pipeline or CLI tool without sharing your account password. Scoped tokens let you grant just the permissions each tool actually needs, so a compromised token limits the damage.

ShipStack shows the token value only once, so you'll copy it straight into your CI secrets or local config.

1

Open Team in the sidebar; tokens live alongside member management.

Open Team in the sidebar — tokens live alongside member management.

 

2

Select Access tokens.

Select Access tokens.

 

3

Set the Token name and Scope; deploy:write is enough for CI.

Name the token after its consumer and give it the narrowest scope that works — deploy:write is enough for CI.

 

Narrow scope means if the token leaks, an attacker can only perform that one action — for most CI jobs, deploy:write is all you need.

 

4

Click Generate token; the value is shown once, so store it in CI secrets immediately.

Click Generate token — the value is shown once, so store it in your CI secrets right away.

 

Once you close this screen, you can't retrieve the token value again — you'll have to generate a new one.

 

5

The token card shows scope, expiry, and last use; rotate or revoke it here.

The token card shows its scope, expiry, and last use — rotate or revoke it here at any time.

Use this card later to check when the token was last used, rotate it on a schedule, or revoke it if you suspect compromise.

What's next

Your token is now live and stored safely in your CI secrets. Test it by running a deploy command from your pipeline to confirm the scope is correct.