Auth model overview
Which credential to use for people, automation, deployments, and agents.
Credentials identify who is calling. Permissions and resource grants determine what that caller can do.
Credential types
| Credential | Used for | Issued through |
|---|---|---|
| Login token | Your dashboard or CLI session | Password or SSO sign-in |
| CLI / service token | CLI and API calls as you | Your account page or CLI login exchange |
| OAuth access token | Machine automation with assigned scopes | OAuth Apps client credentials |
| Deployment token | One operator connection | Deployments |
| SCIM bearer token | Provisioning users and groups | Identity provider settings |
| Agent token | Calls as an agent | Issued automatically for agent runs and sessions |
Login and CLI tokens
Login sessions last 24 hours by default. Administrators can change this in Settings → Security. The CLI exchanges its login for shorter service tokens, lasting three hours by default, and renews them while the login remains valid. These tokens carry your workspace identity and use your current permissions.
For a script, generate a short-lived token from your account page and set EXO_TOKEN. Its lifetime is capped by the workspace's service-token policy, up to 24 hours. Generate another when it expires.
Machine credentials
Create an OAuth App for machine automation. Exchange its client ID and secret using client_credentials for an access token limited to the app's granted scopes. Token lifetime is set on the app and can include no expiry. Keep the client secret secure and rotate it if exposed.
Deployment tokens
A deployment token authenticates one operator connection. It does not grant a person access to the deployment's resources. Copy it when created; rotation immediately invalidates it and disconnects the operator. See Tokens & deployments.
SCIM tokens
Each identity provider has its own bearer token for SCIM user and group provisioning. These are separate from CLI service tokens and OAuth App credentials. Copy the token when issued and replace it in your IdP when rotating it. See SCIM provisioning.
Agent identity
Agent runs and sessions receive short-lived credentials automatically. They act as the agent, with its own permissions and resource grants. Their lifetime follows the workspace service-token policy, three hours by default. See Access control.