Tokens in Artifex

Your build tools reach Artifex with a personal access token that you create in CodeSoh Accounts. This document covers what a token can reach in Artifex and how to grant it.

A token reaches only what it's granted

A token starts with access to nothing, including repositories that you own. Each repository that it should reach needs its own grant, so a token that leaks reaches only the repositories you chose.

A grant never lifts a token above its owner. The permission that applies is the lower of the two:

You hold	Token granted	Token has
Admin (owner)	Write	Write
Write	Read	Read
Read	Write	Refused when granted
Read, after being reduced from write	Write, granted earlier	Read

A token can hold read or write permission, never admin. Settings, sharing, and upstreams are changed by a person in a browser.

In a public repository, a token with no grant can still read, because anyone can.

Grant a token access to a repository

You grant your own tokens. You need the permission in the repository that you're granting.

To grant a token, follow these steps:

1. Open the repository and go to Tokens.
2. In the Token list, select one of your Artifex tokens.
3. Under Permission, select Read or Write.
4. Click Grant access.

Granting a permission that you don't hold is refused, and the message says that you can't give a token access that you don't have yourself.

Remove a grant

To remove a grant, follow these steps:

1. Open the repository and go to Tokens.
2. In the token's row, click Remove.

You can remove a grant for your own token. An administrator of the repository can remove anyone's.

The tool that used the token starts getting 403 Forbidden on the next request.

See where your tokens can reach

The Tokens page of your Artifex account lists your Artifex tokens with the repositories each one can reach and the permission it holds there. It's the fastest way to check what a token would still reach before you decide whether to revoke it.

To stop a token everywhere at once, revoke it in CodeSoh Accounts. For more information, see Personal access tokens.

How a tool presents a token

Artifex accepts either of the following:

• HTTP Basic authentication, where the password is the token and the user name is anything. This is what Maven and Gradle send.
• An Authorization: Bearer header carrying the token.

A revoked or expired token is treated as no credentials at all.