sk_live_ prefix.
Creating a token
Tokens are scoped to the organization, not to a workspace.sk_live_...) is shown once at creation. Store it somewhere safe — you can’t
retrieve it again.
Tokens can have an optional expiry. Pass a duration with --expires.
--expires nor --no-expire is passed. Pass
--no-expire to create a never-expiring token non-interactively.
Attaching a role
A token with no role attached cannot do anything. Attach a role at creation time with--role:
--role can be passed multiple times to attach more than one role. Running sf tokens create
without --role shows an interactive multi-select picker over your available roles.
Roles attached this way apply organization-wide. To scope a token’s role to a single workspace, or
to grant a role to an existing token, create the grant explicitly with sf grants create. See
Grants.