# Tokens

> Deploy tokens: scoped, revocable credentials for CI and automation, with an optional lifetime and IP lock, that never expose your API key.

Source: https://docs.shipstatic.com/tokens

A token is a scoped, revocable deploy credential. Use tokens to grant temporary deploy access without sharing your API key.

Available via [CLI](https://docs.shipstatic.com/cli), [SDK](https://docs.shipstatic.com/sdk), and [API](https://docs.shipstatic.com/api).

## Shown only once

When you create a token, the response contains the **full secret** — a `deploy-{32 hex}` string. **Copy it immediately.** It is shown once and cannot be retrieved later. List endpoints return only a short identifier; the full secret is never returned again.

If you lose a token, revoke it and create a new one.

## Properties

| Property | Description |
|----------|-------------|
| `token` | Short identifier for management (full secret returned only on create) |
| `labels` | Tags for organization (e.g. `ci`, `staging`) |
| `created` | Creation timestamp |
| `expires` | Expiration time (optional, set via TTL in seconds at creation) |
| `used` | When the token was last used |
| `ip` | If set, the token may only be used from this IP. Captured automatically from the first request that uses it |

## Tokens vs API Keys

| | API Key | Token |
|---|---------|-------|
| Lifetime | Persistent | Expires (optional TTL) |
| Usage | Unlimited | Reusable until expiry or revocation |
| Scope | Full account access | Deploy only |
| Per account | One | Unlimited |
| IP lock | No | Optional |

**There is one credential slot, so there is no precedence to reason about.** You pass one value — `--token`, `SHIP_TOKEN`, or the `token` constructor option — and the platform classifies it by its prefix. See [API Key](https://docs.shipstatic.com/api-key).

## Use Cases

**CI/CD.** Create a token with a short TTL for each pipeline run. It expires automatically.

**Integrations.** Give each tool that deploys on your behalf its own token instead of your API key. Set a TTL to expire it, or revoke it any time.

## Operations

| Operation | Description |
|-----------|-------------|
| Create | Generate a new token with optional TTL and labels |
| List | All active tokens on your account |
| Delete | Revoke a token |