API tokens

Tokens that let CI runners, suluctl, and the REST API talk to Sulu.

Generating

In Profile → API keys, click + Generate token. Sulu shows the token once — copy it now.

Using

Pass the token as a Bearer header:

curl -H 'Authorization: Bearer YOUR_TOKEN_HERE' \
  https://your-sulu-instance/api/launches?projectId=42

suluctl and CI tooling read it from the SULU_TOKEN env var (or sulu.properties).

Scope

Tokens are user-scoped. A single token can be used across all projects you have access to.

Revoking

Hover the token row and click the trash icon. Confirm. The token is invalidated immediately — running jobs using it will start failing on their next request.

Rotating

Generate a new token, update the consumer (CI variable, SDK config), then revoke the old one. There's no in-place rotation in v1.

Security

Treat tokens like passwords. Do not commit them to source control. Use your CI secret manager.