CLI reference
norcube auth ci-token create
Create a CI token; the secret is printed once
Not verified yet
Creates a CI token in the organization (--org, else the profile's) and prints its secret. Norcube stores only a hash: copy the secret into your CI system's secrets now, as NORCUBE_TOKEN.
--scopes takes scope names from norcube auth ci-token scopes, for example
langsync.sync (run norcube langsync sync) or backup.read. --expires takes a
duration in hours, days or weeks (12h, 90d, 4w) or a date (2027-01-31); the
default is 90 days, the maximum 366.
With -o text only the secret is printed, so it can go straight into a secret store:
norcube auth ci-token create --name deploy --scopes langsync.sync -o text | gh secret set NORCUBE_TOKENUsage
norcube auth ci-token create --name <name> --scopes <scope,...> [--expires 90d] [flags]Examples
norcube auth ci-token create --name "GitHub Actions" --scopes langsync.sync
norcube auth ci-token create --name nightly-backup-check --scopes backup.read --expires 30d
norcube auth ci-token create --name deploy --scopes langsync.sync -o text | gh secret set NORCUBE_TOKENFlags
| Flag | Default | Description |
|---|---|---|
--expires | 90d | Lifetime (12h, 90d, 4w) or expiry date (2027-01-31); at most 366 days |
--name | What the token is for, e.g. "GitHub Actions deploy" (unique among the organization's live tokens) | |
--scopes | Comma-separated scopes (see norcube auth ci-token scopes) |
Every command also takes the global flags: --profile, --org, -o, --query, --debug and more.
See also
norcube auth ci-token: Create, list and revoke CI tokens for automation