Skip to main content
The Chainloop CLI supports three methods to authenticate with the Chainloop Platform:

​
User Authentication

  • Purpose: For interactive use and attestations
  • Association: Tied to a user account.
  • Duration: Valid for 24 hours
They can be obtained by running the chainloop auth login command.

​
Chainloop API tokens

  • Purpose:
    • For non-interactive use (automation) such as CI/CD.
    • To perform attestations
  • Association: Project-scoped, product-scoped, or organization-scoped.
  • Features:
    • Customizable expiry and manual revocation.
    • Supports fine-grained ACL for access control.
You can operate on your organization API tokens using the chainloop organization api-token command.
You can manage your API tokens in the API Tokens Section.
The API Tokens settings page listing organization tokens
and then they can be used by the CLI by either setting CHAINLOOP_TOKEN environment variable or by using the --token flag, for example

​
Product-Scoped API Tokens

A product-scoped API token belongs to one product. It reaches every project assigned to the product, and it follows the product:
  • When you assign a project to the product, the token reaches that project.
  • When you unassign a project, the token loses access to it, unless another version of the product still includes it.
  • A token of a product with no projects reaches no project.
On each project that it reaches, a product-scoped token can do what a project-scoped token can do there, for example perform attestations and read the project’s data. It has no access to the product itself, such as its versions or its compliance. It cannot list, create, or revoke API tokens, and it cannot change organization-level resources such as policies, policy groups, requirements, frameworks, workflow templates, or organization contracts. These callers can manage the tokens of a product:
  • Organization owners and admins, and the Product Admins of the product, can create, list, and revoke them.
  • Product Viewers can list them with the CLI or the API.
  • Organization API tokens can create, list, and revoke them, for example to provision tokens unattended.
Users whose organization role is Org Viewer cannot manage or list product-scoped tokens, whatever their product role. Project-scoped and product-scoped API tokens cannot manage them either. A revoked token is refused on its next request. When you delete a product, its tokens reach no project. They stay in the organization’s API token list, where you can revoke them.
To manage the tokens of one product, open the product, open the Actions menu, and select Manage API tokens. The sheet lists the product’s tokens. Use Filter to show revoked tokens, Create to create a token, and the row action to revoke a token. When you create a token, the form states how many projects the product’s tokens reach, and warns you when the product has no projects.
The Manage API tokens sheet of a product, listing its tokens
You can also create a product-scoped token in the API Tokens Section: select Create, set Scope to Product, and select the product. The organization’s list shows the product as the scope of its tokens.
The Create API Token sheet with the product scope selected
The token value is shown once, right after you create the token. Copy it then: you cannot see it again.
Use a product-scoped token like any other API token. In commands that need a project, name one of the product’s projects:

​
Auto-Revocation of Inactive Tokens

Organization administrators can configure Chainloop to automatically revoke API tokens that have not been used within a defined period. This helps reduce the risk of long-lived, forgotten tokens being misused. A background job runs hourly and checks all active tokens in your organization. A token is considered inactive if:
  • Its last used timestamp is older than the configured threshold, or
  • It has never been used and was created before the threshold.

​
Enable Auto-Revocation

Navigate to the API Tokens settings page and click the Auto revoke button to configure the inactivity threshold.
The Auto revoke dialog configuring the days of inactivity threshold
This feature is off by default. You must explicitly set a threshold to enable it. The setting is configured per organization.

​
Disable Auto-Revocation

To turn off auto-revocation, set the threshold to 0 or toggle it off in the Web UI:

​
View the Current Setting

To check the current auto-revocation threshold for your organization:
If enabled, the output will include the configured threshold, for example API token auto-revoke after: 90 days inactive.

​
Keyless OIDC Authentication

In some cases, like in GitLab, you can leverage their CI/CD machine identity to authenticate with Chainloop instead of Chainloop API tokens. More info here
  • Purpose:
    • For non-interactive use (automation) such as CI/CD.
    • To perform attestations
Check the GitLab Keyless Attestations guide for more information.