API tokens

You use an API token where there is no browser to log in with: on a server, in a CI pipeline or in your own scripts. A token only works in the workspace you create it in. Keep it secret, like a password.

On your own computer you usually don’t need a token: npx @cubli/cli login logs in through your browser.

Create a token

1. Go to Settings, API tokens and click Create token.
2. Give it a Name after where you use it, for example “laptop” or “github-actions”.
3. Under What may it do?, choose:
   • Deploy and manage: an admin’s rights.
   • Read only: look, change nothing.
4. Under Where?, choose whether the token works for All projects in this workspace or for one project.
5. Click Create token.

You see the token, as a ready-made login command. Copy it now: it is shown only once. Click Copy command.

A token is valid for 90 days. The list shows when it expires, who made it and when it was last used. Viewers don’t see the API tokens page.

Log in with a token

npx @cubli/cli login --token <token>

Or put the token in the CUBLI_TOKEN variable and run npx @cubli/cli login. After that every command works, as in a CI step:

npx @cubli/cli login --token "$CUBLI_TOKEN"
npx @cubli/cli up -m "deploy from CI"

In CI the folder has no .cubli.json (it stays out of git). So run npx @cubli/cli link --project <id> first.

The API itself

The CLI and the AI tools use the API at https://api.cubli.io. You can call it yourself too, with your token as a Bearer token:

curl -H "Authorization: Bearer $CUBLI_TOKEN" https://api.cubli.io/v1/me

The full description of the API is available as OpenAPI at https://api.cubli.io/openapi.json. A token never has more rights than whoever made it.

Revoke a token

Click Revoke next to the token in the list. It stops working at once. A CLI login through the browser is listed here too, and you revoke it the same way.