Tokens

A token lets a machine push to or pull from the caches you pick, until it expires or you revoke it.

What a token can do

• Push uploads builds. Give one to CI.
• Pull reads a private cache. Give one to each machine that substitutes from it.
• Push and pull does both, for a builder that also reads.

Each token only reaches the caches you choose when you create it. Public caches need no token to pull from, so a pull token is only for private ones.

Create one

In the dashboard, open Tokens and choose Create token. Name it after what will use it, like github-actions or build-server-2, so you know what stops working if you revoke it. Pick how long it lasts: 30 days, 90 days, or a year.

The token is shown once, right after you create it. We don't keep a copy, so copy it into your CI secrets or the machine's netrc file before you close the dialog. If you lose it, revoke it and create another.

Revoke one

Choose Revoke next to the token. Anything using it stops working within seconds. Tokens that are about to expire are marked a week ahead, so you can replace them before CI starts failing.