Access and machine tokens
Choose least-privilege permissions and constrain automation to one vault or environment.
Human access
Secrets belongs to the organization, not to an individual developer's CLI installation. Organization members can read, reveal, and manage values in existing environments. Owners and admins manage vaults, environments, machine tokens, shares, and Trash recovery/purge.
Browser login authenticates a person. CLI operations using that login remain tied to current organization membership; a saved organization selection is not authorization by itself.
Create an automation credential
As an owner/admin, open API tokens, choose a descriptive name, and select only the needed Secrets permissions:
| Permission | Scope | Allows |
|---|---|---|
| Read | secrets:read | List, reveal, export, pull, and inject values |
| Write | secrets:write | Create, update, import, and roll back values |
| Delete | secrets:delete | Delete individual secrets |
For an application launcher, Read is normally enough. An import job needs Write. The CLI's mutation workflow also reads current metadata to detect conflicts; do not confuse metadata reads available to a mutation token with permission to reveal values.
Choose One environment for a single deployment target, One vault when automation needs every environment in that vault, or Entire workspace only when necessary. The vault/environment boundary restricts Secrets; any Tunnels or Observability permission on the same token remains workspace-wide.
Select expiry (30 days, 90 days, one year, or never), copy the full token once, and store it in the runner's secret manager as OUTRAY_TOKEN. Supply the target slugs explicitly or through config:
outray secrets run --org my-team --vault orders-api --env production \
--confirm-production -- node dist/server.jsThe command assumes the runner already supplies OUTRAY_TOKEN; do not put a real token in the command line or repository.
Lifecycle and troubleshooting
The dashboard shows masked token metadata, expiry, state, and last use. Revoke a credential when it is exposed or no longer needed. Replace expiring credentials in dependent automation before retiring the old one.
A Read token can disclose plaintext values, so treat it as sensitive even though it cannot mutate them. Machine scopes do not grant container management, share creation, or Trash restore/purge.
For denied access, check all three boundaries: organization, permission, and vault/environment. For production confirmation errors, add the explicit confirmation only after verifying the target. For invalid or expired credentials, issue a replacement rather than copying a masked token prefix.
See platform API tokens for permissions spanning multiple products.