Deployment Tokens

Generate and revoke project tokens for external deployment automation.

This guide covers token visibility, hashing behavior, token creation, and token deletion.

About Deployment Tokens

A deployment token is a project-scoped credential that lets external workflows trigger deployments without an active browser session. Use deployment tokens for command-line interface (CLI) tools or continuous integration and continuous delivery (CI/CD) pipelines.

The control plane shows the plaintext token only once after creation. After you close the creation dialog, you can see only the masked token preview.

Token Security

The control plane does not store plaintext deployment tokens. It verifies tokens with a Secure Hash Algorithm 256-bit (SHA-256) hash salted by the ML_DEPLOYMENT_TOKEN_SALT environment variable.

WARNING: If ML_DEPLOYMENT_TOKEN_SALT is not configured, token generation fails and the interface shows a configuration error.

Generating a Token

To create a token for an external deployment workflow and generate a deployment token, you can use the deployment tokens settings page.

Before you start

You must have access to an external secret manager where you can store the plaintext token.

Steps

1. Click Projects in the global sidebar.
2. Click your target project.
3. Click Settings > Deployment Tokens in the project sidebar.
4. Click Generate deployment token.
5. Click the copy icon next to the token value.
6. Save the token in your external secret manager.
7. Click Close.

What happens next

The control plane adds a masked token preview to the deployment tokens table.

Deleting a Token

To revoke a deployment token and remove a token that is compromised or no longer needed, you can use the deployment tokens table.

Before you start

You must confirm that no active automation still depends on the token.

Steps

1. Locate the token preview in the table.
2. Click the trash icon in the actions column.
3. Click Delete in the confirmation dialog.

What happens next

The control plane revokes the token and removes the row from the table.