Tokens for scripts and CI

At your own terminal, apex login is all you need: it signs the CLI in through your browser and keeps the token for you. A script, a CI job or another machine needs a token of its own, passed in APEX_TOKEN.

What a token can do

• Repository secrets and variables, nothing else. A token cannot run workflows, read logs or change billing.
• Only what GitHub says you may do. On every request, Apex asks GitHub what you may do on that repository. Lose admin rights there and the token loses them too, within five minutes.
• Optionally, only some repositories. Name up to 100 when you create it; otherwise it reaches every repository you administer.
• It always expires. 30 days unless you choose otherwise, 90 at most. Revoking one takes effect at once.

Create one

apex token create ci-deploy --expires-in-days 30 --repo acme/api

Your browser opens to approve it, showing the name, the expiry and the repositories. The CLI then prints the token once. It is not saved anywhere, so store it where it will be used, such as a CI secret. Only the token goes to standard output, so you can capture it:

TOKEN=$(apex token create nightly-sync --repo acme/web --repo acme/api)

--no-browser prints the approval address instead of opening it. The approval returns to the CLI on the same machine, so open the address in a browser there. For a machine with no browser at all, create the token on the dashboard under Settings → API tokens instead. It is the same kind of token.

Use it in CI

Store the token as a secret in your CI system and expose it as APEX_TOKEN. The CLI prefers APEX_TOKEN over a saved login.

- run: npm install -g @apex-actions/cli
- run: printf %s "$NPM_TOKEN" | apex secret set NPM_TOKEN --repo acme/api
  env:
    APEX_TOKEN: ${{ secrets.APEX_TOKEN }}
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

apex whoami tells you which credential the CLI is using and when it expires.

List and revoke

apex token list          # active tokens: name, id, last four characters, expiry, last use
apex token list --all    # expired and revoked ones too
apex token revoke <id>   # one token, immediately
apex token revoke --all  # every token you hold

A list never shows a token itself, only its last four characters. Revoking works from any credential you hold, including the token being revoked. Revoking only ever takes access away. To sign the CLI itself out, use apex logout, which revokes the token apex login saved and deletes it.

Every option is in the CLI reference.