CI Tokens tab

The CI Tokens tab of the CI/CD Pipelines screen (/pipelines?tab=tokens) manages the credentials CI jobs authenticate with.

What a CI token is

A CI token is a machine credential — separate from user logins — scoped to two things: triggering runs and reading their status. It cannot browse test cases, change settings, or read your project. Tokens start with tvci_ and are stored hashed on the server, which is why the value can only be displayed once.

Creating a token

Type a descriptive name (e.g. github-pr-gate, jenkins-release) and click Create Token. The value appears in a dialog with a copy button.

Caution

Copy it now. The token is shown once and cannot be retrieved afterwards — if you lose it, revoke it and create a new one.

Store it as a secret in your CI platform, conventionally named TESTVER_CI_TOKEN:

Platform	Where the secret goes
GitHub Actions	Settings → Secrets and variables → Actions
GitLab CI	Settings → CI/CD → Variables (tick Masked)
Jenkins	Manage Jenkins → Credentials → Secret Text, with id testver-ci-token
Azure Pipelines	Pipeline → Edit → Variables, tick Keep this value secret
Bitbucket Pipelines	Repository settings → Repository variables, tick Secured
CircleCI	Project Settings → Environment Variables (or a shared context)

For local use, export it instead: export TESTVER_CI_TOKEN=tvci_…, or pass --token to testver trigger.

The token list

Each row shows the token name, its prefix (the first few characters, enough to tell tokens apart without revealing the value), when it was created, and when it was last used.

Tip

The last used column is the quickest way to find tokens no pipeline needs any more — a token that hasn’t been used in months is a credential you can safely revoke.

Revoking a token

The ⊘ button revokes a token immediately. Any job still using it fails at the trigger step with Invalid or revoked CI token, which is what you want when a token leaks or a project is retired.

Revoking is permanent — it does not delete the record, so the name stays visible in your history, and the name becomes available for a new token again.

Good practice

• One token per pipeline or team. Sharing a single token everywhere means a leak forces you to rotate every pipeline at once.
• Name tokens after where they live, not what they do — github-pr-gate tells you exactly which secret to update after revoking it.
• Rotate on people changes. Tokens outlive employees; revoking and re-issuing costs a minute.
• Never commit a token. It belongs in your CI platform’s secret store, not in the pipeline file — the generated configs read it from a secret for exactly this reason.

Troubleshooting

Symptom	Likely cause / fix
Invalid or revoked CI token (401)	The token was revoked or mistyped, or the CI secret isn’t reaching the job. Confirm the secret name matches the pipeline config.
I lost the token value	It cannot be recovered. Revoke it and create a replacement.
”An active token named … already exists”	Names must be unique among active tokens. Pick another name, or revoke the old one first.
Last used stays empty	Nothing has authenticated with it yet — the CI job may still be failing before it reaches Testver.

Related

• CI/CD Pipelines overview — where tokens fit in the setup flow.
• Pipelines tab — generate the config that consumes this token.
• CI Runs tab — the Triggered by column shows which token started each run.