Skip to main content
Setting up a CI/CD pipeline? Use a CI deploy token instead: a least-privilege fjall_dk_ token built for pipelines, minted in the web app under Settings → CI/CD Tokens (minting is session-only, so the CLI cannot create one). See CI/CD Integration.

​
Overview

fjall token mints scoped fjall_ak_ API tokens for AI agents, scripts, and automation acting as you. Create one per consumer, scope it to what that consumer needs, and revoke it independently when it is done. Consumers authenticate by setting the token as the FJALL_API_KEY environment variable instead of running an interactive fjall login. FJALL_API_KEY takes precedence over the stored login in ~/.fjall/auth.json (or $FJALL_CONFIG_DIR/auth.json). For pipelines, prefer a CI deploy token (fjall_dk_, minted in the web app under Settings → CI/CD Tokens): it carries a fixed least-privilege scope set and doubles as the pipeline’s AWS credential.
fjall token is the home for these commands. There is no fjall user token subcommand.

​
Prerequisites

  • A Fjall login (fjall login). Every subcommand authenticates first.
  • A subcommand. Bare fjall token prints usage rather than acting.
  • admin scope to run token create or token revoke. A token minted with the default scope set cannot mint or revoke other tokens.

​
Subcommands

​
Create a token

The plaintext token is the result, so it is the only thing on stdout — bare, with no prefix and no surrounding text. The token id, name and prefix are commentary and go to stderr with the rest of the conversation. In --agent mode the token rides the TOON result block as token, verbatim and unmasked, because it is the value the caller ran the command to receive.
The token value is shown once. Store it in your secret store immediately.

​
List tokens

Each row shows the token’s name, prefix, status (active, expired, or revoked), and a constraint summary such as env=staging acct=production app=2. Use --agent for structured output.

​
Show a token

Prints the id, name, prefix, status, scopes, every constraint axis, expiry, creation time, last-used time, and request count. Constrained accounts are listed by name alongside the stored id.

​
Revoke a token

--reason is optional, and recording one makes the audit trail readable later.

​
Scopes

--scope accepts a comma-separated list. The default, *, expands to every user-grantable scope except destroy and admin. Two further scopes, deploy:oidc:mint and deploy:governance, belong to CI deploy tokens only. Requesting either from fjall token create is refused with a pointer to Settings → CI/CD Tokens.
admin cannot combine with any other scope, and an admin token expires within 24 hours. Every other scope set caps at 90 days.

​
Restrict a token

Three constraint axes narrow what a token may touch. Combine them freely.
  • --app and --account are repeatable and accept a name or an id. Fjall resolves each input before minting, and an unresolvable name fails the mint rather than issuing a wider token.
  • --environment takes a single free-form environment name.
  • A token with no constraints can act on every application, environment, and account its scopes reach.

​
Destroy-scoped tokens

Teardown rights are never granted by default, and two extra mint gates apply.
1

Request destroy explicitly

Name the scopes rather than relying on *: --scope read,deploy,destroy.
2

Name the environments it may destroy

A destroy scope without --environment <name> is refused at mint time.
3

Acknowledge production, if it is in scope

When --environment names production (any casing), add --confirm-production-destroy.

​
Use a token

To capture the token in a script, just capture stdout — nothing else is on it, and a mint that fails writes nothing there at all, so the variable is either the token or empty:

​
Next Steps

Agent Mode

Run Fjall from AI agents with structured output and field selection.

fjall ci

Mint CI deploy tokens, wire up pipelines, and run deploys from CI.

CI/CD Integration

Deploy to AWS from pipelines with a least-privilege CI deploy token.

fjall login

Sign in interactively and see where Fjall stores your credentials.