Olibato personal access tokens authenticate the CLI and REST API as your user. The token can perform only the actions allowed by both its permission level and your role in the target namespace. A token does not turn an organization member into an admin or owner.
Generate a token#
- Sign in and open Account.
- Find API access and choose Generate token.
- Give the token a name that identifies the laptop or automation using it.
- Choose an expiration period. Ninety days is selected by default.
- Keep the recommended Write permission for
olibato push, or choose Read for inspection-only automation. Use Owner only for credential management or irreversible operations. - Choose Generate token.
Write permission can read namespaces and sites, create deploys, upload temporary source, update site settings, and operate runtimes. It does not include credential management or irreversible owner operations.
The same lifecycle is available through the API. POST /auth/registration/verify
returns the first owner token for a newly verified API account. Existing owner
tokens use GET|POST /account/tokens and DELETE /account/tokens/{id}.
Save the token#
The complete oli_pat_… value is displayed once. Copy it before leaving or
refreshing the page:
olibato login --token "oli_pat_…"
The CLI saves the credential in the operating-system credential store. For
headless automation, set OLIBATO_TOKEN in the job's protected secret store
instead of writing it to a repository or configuration file.
Olibato does not retain the complete token. The Account page stores and displays the token name, safe prefix, permissions, creation and expiration dates, last-use time, and status. Authentication uses a keyed verification hash that cannot be turned back into the original token.
Review and revoke tokens#
The API access table lists active, expired, and revoked credentials. Use the last-used time to identify abandoned credentials. Choose Revoke to disable a token immediately; applications using it will begin receiving authentication errors. A revoked or lost token cannot be restored—generate a replacement and update the consuming CLI or automation.
Use separate tokens for separate laptops and automated jobs. This makes a single credential safe to revoke without interrupting every integration.
Recover API-only access#
If every owner token is lost, send the account email to
POST /v/api/v1/auth/token-recovery. The response is always accepted so it
does not reveal whether an account exists. For an active account, Olibato emails
a short-lived, single-use recovery secret. Exchange it at
POST /v/api/v1/auth/token-recovery/confirm to create a replacement owner
token. Store the returned token immediately; its complete value is not shown
again.