API tokens

An API token is a bearer credential for anything that isn't a browser: the sc CLI, an MCP client, a script. A token is you — whatever it can reach, you can reach — so treat it like a password. Every signed-in user can create tokens; no admin has to enable anything.

Tokens are separate from registry keys on purpose: an API token can never docker login, and a registry key can never call the MCP/API.

Creating a token

Open Settings → API tokens in the sidebar. Give the token a label saying where it will live, choose an expiry, and click Create token. The expiry defaults to 30 days; 90 days, a year and never expires are the other choices, and a token that never expires has to be picked deliberately.

The token is shown exactly once, right after creation. Copy it now; it cannot be recovered later, only revoked. The button beside it puts the token on your clipboard, so there is no need to select 70-odd characters by hand.

After a reload only the label, the last four characters, and the metadata remain — the platform stores a hash, not the token.

Using it with sc

Run sc login, paste the token when prompted, and it's stored for future deploys. sc also reads SC_TOKEN from the environment, which is what CI should use.

sc login
sc deploy --app my-app

The link sc login prints — and offers to open — names the machine it is running on, so the form arrives with the label already filled in: on a laptop called bramble, bramble (sc). That is the answer to the question the label exists for, "which box is this?", and it is the one thing the browser cannot know. It is only a suggestion; edit it, or type something else, before creating the token.

When that name is already on your list — the same laptop coming back after its first token expired, or was revoked — the suggestion is numbered instead: bramble (sc) 2. Two rows called the same thing are two rows you cannot choose between when one of them needs revoking.

Nothing is suggested at all when the machine has no name worth using: a bare container reporting localhost, or the string of hex digits Docker gives a container it was never named. Those name every box and none of them, so the field is left blank for you to say what the token is really for.

Last used on the list tells you whether a token is still in service — a deploy updates it. It shows the timestamp with how long ago that was underneath (today, 6 days ago), so a token nothing has touched in months is obvious at a glance. Every deploy is recorded against the user the token belongs to, so an upload is never anonymous.

Revoking a token

Click Revoke next to a token to disable it immediately. Revoked tokens stay in the list for your records but can no longer authenticate, and revocation cannot be undone — create a new token instead.

Expired tokens behave the same way: once a token passes its expiry date it stops authenticating, without needing to be revoked.