Projects can now issue service tokens: credentials for GitHub Actions, Docker, Kubernetes, and serverless runtimes that can't open a browser.

Create one from the new Service Tokens page in your project. The raw token is shown once and stored only as a SHA-256 hash. Pass it to the CLI as APIVAULT_TOKEN:

Shell

APIVAULT_TOKEN=av_live_... apivault run -- npm run build

#Limit what a token can do

Scopes: list keys, reveal decrypted values, and modify keys are separate grants, capped by the role of whoever creates the token.
Environment pin: a pinned token can only read and write that environment, and callers can't override the pin.
IP allowlist: restrict a token to IPv4 or IPv6 CIDR ranges. Requests from anywhere else, or from an unknown address, are refused.
Expiry: every token expires after 7 to 365 days, 90 by default. There is no option for a token that never expires.

#If a token leaks or its creator leaves

Service tokens reach key endpoints and nothing else. Project settings, members, invitations, encryption configuration, and token creation all reject them.

A token belongs to the project, so it keeps working when the person who created it leaves. Removing that person doesn't revoke it, so the token is flagged for review.

Audit logs record token requests and refusals under their own Service source, with a filter for each token. Project owners and admins are notified when a token exports an entire environment.

Learn more in the service tokens documentation.