qovery token

Generate API token

Overview

Generate an API token for authenticating with Qovery programmatically. API tokens are useful for CI/CD pipelines, automation scripts, and integrations.

Command

qovery token

This command generates a new API token that can be used for authentication instead of interactive login.

Usage

qovery token

The command is fully interactive — it prompts you to select an organization, token name, description, and role. There are no flags to pass.

Examples

Generate Token

# Generate new API token (interactive prompts will guide you)
qovery token

# Copy the token output
# Token: qov_abc123def456...

Using API Tokens

In CI/CD Pipelines

# GitHub Actions
env:
  QOVERY_CLI_ACCESS_TOKEN: ${{ secrets.QOVERY_TOKEN }}

# GitLab CI
variables:
  QOVERY_CLI_ACCESS_TOKEN: $CI_QOVERY_TOKEN

# CircleCI
environment:
  QOVERY_CLI_ACCESS_TOKEN: ${QOVERY_TOKEN}

In Scripts

#!/bin/bash

# Set token as environment variable
export QOVERY_CLI_ACCESS_TOKEN="qov_abc123def456..."

# Authenticate
qovery auth

# Run commands
qovery application deploy --application "my-app"

In Local Development

# Add to your shell profile (~/.bashrc, ~/.zshrc)
export QOVERY_CLI_ACCESS_TOKEN="qov_abc123def456..."

# Or create a .env file
echo "QOVERY_CLI_ACCESS_TOKEN=qov_abc123def456..." > .env
source .env

Security Best Practices

Never commit API tokens to version control. Always use secrets management:

• GitHub Actions: Use secrets
• GitLab CI: Use CI/CD variables
• CircleCI: Use environment variables
• Local: Use environment variables or secure vaults

Token Storage

Do:

• Store tokens in CI/CD secret management
• Use environment variables
• Use secure vaults (AWS Secrets Manager, HashiCorp Vault)
• Rotate tokens regularly

Don’t:

• Commit tokens to Git
• Share tokens in plain text
• Use the same token across multiple systems
• Store tokens in application code

Token Rotation

Regularly rotate API tokens for security:

# 1. Generate new token (interactive)
qovery token

# 2. Update CI/CD secrets with new token

# 3. Revoke old token in Qovery Console

Limited Scope Tokens

Generate separate tokens for different purposes by running qovery token for each and providing a descriptive name when prompted:

# For each token, run:
qovery token
# Enter a descriptive name at the prompt, e.g.:
# "Production CI/CD", "Staging CI/CD", "Monitoring Read-Only"

Managing Tokens

Tokens can be managed in the Qovery Console:

1. Go to Settings → API Tokens
2. View all active tokens
3. Revoke tokens that are no longer needed
4. Set expiration dates for tokens

Token Permissions

API tokens inherit permissions from your user account:

• Full Access - Can perform all operations you can perform
• Scoped to Organization - Token permissions apply to specific organization
• Audit Trail - All token actions are logged

Examples by Use Case

CI/CD Deployment

# .github/workflows/deploy.yml
name: Deploy to Qovery

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Install Qovery CLI
        run: curl -s https://get.qovery.com | bash

      - name: Deploy Application
        env:
          QOVERY_CLI_ACCESS_TOKEN: ${{ secrets.QOVERY_TOKEN }}
        run: |
          qovery auth
          qovery application deploy --application "my-app"

Automated Monitoring Script

#!/bin/bash
# monitor.sh

export QOVERY_CLI_ACCESS_TOKEN="${QOVERY_MONITORING_TOKEN}"

qovery auth

# Get status of all services
qovery status --format json > status.json

# Check for errors
if jq -e '.services[] | select(.status == "ERROR")' status.json > /dev/null; then
  echo "ERROR: Services with errors detected"
  # Send alert
fi

Tips

Generate separate tokens for different environments (production, staging, development) to limit blast radius if a token is compromised.

Use descriptive names when generating tokens to easily identify their purpose later.

Related Commands

• qovery auth - Authenticate with token
• qovery context - Set working context