Skip to main content
Tokens authenticate requests to the SF Compute API. Use tokens for CI/CD (continuous integration and delivery) pipelines, automation, and service accounts. Tokens use the sk_live_ prefix.

​
Creating a token

A token applies to your whole organization, not to a single workspace. Creating or deleting a token requires a role with token permissions. See Roles.
The CLI prints the token value (sk_live_...) once, at creation. Store it somewhere safe. You can’t retrieve it again. To set an expiry, pass a duration with --expires.
Without --expires, interactive runs prompt for an expiration and non-interactive runs default to 90 days. Pass --no-expire to create a token that never expires.

​
Attaching a role

A token with no role attached cannot do anything. Attach a role at creation time with --role, and pass --workspace to limit it to 1 workspace or --org to apply it organization-wide.
training-operator is a custom role you create yourself. To run this as-is, attach a built-in role like operator. See Roles. As with other commands, -w and SF_WORKSPACE also set the workspace. --org overrides SF_WORKSPACE, and can’t be combined with -w or --workspace. With no workspace and no --org, interactive runs let you pick a workspace or organization-wide, and non-interactive runs exit with an error, so scripts pass --workspace or --org. Pass --role multiple times to attach more than one role. Every role gets the same scope. Running sf tokens create without --role shows an interactive multi-select picker over your available roles. To grant a role to an existing token, use sf grants create. See Grants.

​
Listing tokens

List every token in your organization.

​
Deleting a token

Delete a token by name.
Deleting a token revokes it immediately. In-flight requests authenticated with the token fail.

​
Using a token

See Using the API to authenticate requests with your token.