Short-lived deploy tokens by default
v2.13.2Security
CI tokens now expire after one hour and are scoped to a single project.
New deploy tokens created from the dashboard or the CLI now expire after one hour and can only deploy the project they were created for.
What changes
cloud tokens createissues a one-hour token unless you pass--ttl- Tokens are scoped to one project and one environment
- Existing long-lived tokens keep working until Jan 2027
What to do
If your CI stores a long-lived token, switch to OIDC tokens issued by your CI provider, or create a new token in each pipeline run:
bash
cloud tokens create --project web-frontend --env production --ttl 1h