Skip to main content
Tokens authenticate requests to the SF Compute API. Use tokens for CI/CD (continuous integration and delivery) pipelines, automation, and service accounts. Tokens use the sk_live_ prefix.

​
Creating a token

A token applies to your whole organization, not to a single workspace. Creating or deleting a token requires a role with token permissions. See Roles.
The CLI prints the token value (sk_live_...) once, at creation. Store it somewhere safe. You can’t retrieve it again. To set an expiry, pass a duration with --expires.
Without --expires, interactive runs prompt for an expiration and non-interactive runs default to 90 days. Pass --no-expire to create a token that never expires.

​
Attaching a role

A token with no role attached cannot do anything. Attach a role at creation time with --role.
training-operator is a custom role you create yourself. To run this as-is, attach a built-in role like operator. See Roles. Pass --role multiple times to attach more than one role. Running sf tokens create without --role shows an interactive multi-select picker over your available roles. Roles attached this way apply organization-wide. To scope a token’s role to a single workspace, create the grant explicitly with sf grants create. Use the same command to grant a role to an existing token. See Grants.

​
Listing tokens

List every token in your organization.

​
Deleting a token

Delete a token by name.
Deleting a token revokes it immediately. In-flight requests authenticated with the token fail.

​
Using a token

See Using the API to authenticate requests with your token.