API tokens
Create scoped API tokens for headless and CI authentication — read/publish/admin scopes, per-registry restriction, and the token shown once.
Interactive login uses the browser device flow, but automation can't open a browser. For headless and CI use, SkillHub issues API tokens: scoped, long-lived credentials you can hand to a pipeline.
Create a token
skillhub token create --name ci --scopes read,publishThe full token secret is printed once in the response and never shown again —
copy it into your secret store immediately. If you lose it, create a new one. A
token looks like skh_live_<32 chars> (test-environment tokens use the
skh_test_ prefix instead).
Treat a token like a password. It carries its scopes on behalf of your account, so never commit it to a repo, paste it into a chat, or print it in CI logs — keep it in a secret store and revoke it from the dashboard the moment it leaks.
Scopes
A token carries one or more scopes, so you can grant a pipeline only what it needs:
| Scope | Grants |
|---|---|
read | Resolve and install skills. |
publish | Publish versions and move dist-tags. |
admin | Administrative actions, including promotion on review-required registries. |
A read-only install token, for example, needs just read:
skillhub token create --name deploy --scopes readRestrict a token to one registry
Pass --registry to scope a token to a single registry, so a leaked CI token
can't touch anything else:
skillhub token create --name ci --scopes publish --registry @studio/design-systemsUse a token for auth
A token authenticates two ways:
-
login --tokenstores it like any other credential (OS keychain, falling back to a0600-mode file):skillhub login --token <api-token> -
The
SKILLHUB_TOKENenvironment variable — set it in your CI environment and skip the login step entirely. An environment token takes effect without any stored credential, and stays active even afterskillhub logout.
Prefer SKILLHUB_TOKEN in CI: it keeps the secret in your pipeline's secret
store and leaves nothing on disk.
Managing tokens
Creating tokens is the only token action in the CLI. Listing and revoking tokens are dashboard operations — open the dashboard to review or revoke a token:
skillhub openJSON output
With --json, skillhub token create returns a data object containing:
action—"create".token— the full secret, shown once.info—{ id, name, prefix (12 chars), scopes[] of read | publish | admin, registryId (uuid | null), lastUsedAt, expiresAt, revokedAt, createdAt }.