Tokens overview
This page covers Alpacon’s two deployment tokens: API access tokens for programmatic API access, and server registration tokens for automated server onboarding.
Setting up CI/CD? CI/CD and other unattended automation run on service tokens, which are issued to an application rather than to a person and are bounded by their own ACL rules.
Token types
| Feature | API access token | Server registration token |
|---|---|---|
| Purpose | Programmatic API access under your own identity | Automated server registration |
| Where to manage | Account menu at the bottom of the left sidebar → My API tokens | Within the server registration flow |
Common behaviors
Token key visibility
The token key is displayed only once at the time of creation. After leaving the page, it cannot be retrieved again.
Expiration presets
When creating a token, you can choose from the following expiration options:
- 7 days
- 30 days
- 90 days
- 1 year
- Custom date
- No expiration—Tokens without an expiration date pose a security risk. We recommend setting an expiration date and rotating tokens on a regular basis.
- API access token—Manage API tokens with scoped permissions
- Command patterns and sudo—Write allowed-command rules that match, and understand token elevation
- Server registration token—Manage tokens for automated server onboarding
- Register a server—Server registration methods including token-based registration
- API reference: Tokens—REST API endpoints for token management