Create an API token#

API tokens let the sysand client publish projects and perform other authenticated package-index actions. Prefer trusted publishing over API tokens for existing projects when that fits your workflow.

Before you start#

You need a Sysand Index account. To create or revoke a project token, you need effective Owner or Maintainer access to that project. Effective access can come from direct project membership or from an organization team with project access.

Organization Owner access by itself does not grant project-token access; see Roles and permissions.

For exact token prefixes, limits, and upload authorization rules, see API tokens.

Choose the token type#

Sysand Index supports account tokens and project tokens. Project tokens are scoped to one existing project. Account tokens use your account permissions and can also be used to create a new project.

To create a new project in an organization namespace with an account token, you must be an Owner or Manager of that organization. After the project exists, account-token uploads require effective project Owner or Maintainer access.

Create a token#

  1. Go to Settings -> Tokens.

  2. Under Create new token, enter a descriptive name and choose an expiry.

  3. Press Create token.

  4. Copy the token from the confirmation dialog before closing it.

The token will start with sysand_u_.

  1. Go to Projects.

  2. Click Manage on an existing project.

  3. Click the tokens tab.

  4. Under Create new token, enter a descriptive name and choose an expiry.

  5. Press Create token.

  6. Copy the token from the confirmation dialog before closing it.

The token will start with sysand_p_.

Because tokens are long-lived credentials, the index may first ask you to confirm your identity with your password or a two-factor code before the token is created.

The new token appears in the token list on the same page, showing its name, display prefix, and expiry date.

Configure sysand to use an API token#

To use the token with sysand, for example with sysand publish, store it with sysand auth login, pasting the copied token at the hidden prompt:

$ sysand auth login https://sysand.com

This checks the token against the index and stores it in your operating system’s keyring, so it works in every terminal from now on. Once the token is stored this way you do not need the plaintext again, so closing the creation dialog without saving it elsewhere is fine. In CI, or on a host without a keyring, use the SYSAND_CRED_* environment variables instead; that path, and private indexes in general, are covered in Authenticate to an index.

Verify#

sysand auth login already validated the token: the validated (api) in its output means the index accepted it. To re-check later, or to see who a stored token authenticates as, run sysand auth whoami https://sysand.com.

For a safe first publish, use the test index as described in Publishing your first project. For authentication and permission failures, see API tokens.