Why deploy tokens now expire after one hour

Deploy tokens used to live forever. They were created once, pasted into a CI secret, and forgotten. That made them the most common credential in our incident reports: copied into logs, left in old forks, or shared between projects.

New deploy tokens now expire one hour after they are issued. Existing long-lived tokens keep working until January, and the dashboard shows which projects still use them.

How short-lived tokens work

Instead of storing a token, your CI provider proves who it is with its own identity token (OIDC). The platform checks that the identity matches a trust rule you created, then issues a deploy token that is valid for one hour and scoped to one project.

deploy:
  permissions:
    id-token: write
  steps:
    - run: npm ci
    - run: npx cloud deploy --env production
      env:
        CLOUD_OIDC: "true"

Nothing secret is stored in the repository or the CI settings. A leaked token stops working within the hour.

Create a trust rule

A trust rule says which repository, branch, and environment may deploy to a project. Create one in Project → Settings → Deploy access, or from the CLI:

cloud trust create \
  --project web-frontend \
  --repository your-org/web-frontend \
  --branch main \
  --env production

Rules are evaluated on every exchange, so removing a rule cuts access right away.

What changes for you

• Pipelines that use the official CI integration switch automatically on the next run.
• Pipelines that call the API with a stored token keep working until January. After that, the stored token is rejected.
• Personal access tokens for the CLI are not affected. They still expire after 90 days, as before.

If your CI provider does not support OIDC yet, create a token with an explicit expiry of at most seven days and rotate it from a cron job.