API tokens

API tokens let the zeon CLI sign in to Zeon without a browser. Each token belongs to you and grants the same access as your account does. You manage tokens at https://zeonsystems.app/account/api-tokens.

When you need one

• You're using the CLI. zeon auth login will mint one for you automatically; this page is for managing those tokens after the fact.
• You're scripting against Zeon (a deployment pipeline, a scheduled job) and need a token to put in an environment variable.
• You want to revoke a token on a machine you no longer have access to.

You don't need a token to use the Web IDE or the main app. Those use your browser session.

What a token looks like

Tokens are strings prefixed with zat_, short for Zeon API token. Example: zat_aBc123….

They're long, random, and shown only once at the moment you create them. After you close the creation dialog, only a SHA-256 hash is kept; Zeon literally can't show you the plaintext again. If you lose it, revoke that token and mint a new one.

Creating a token

1. Open https://zeonsystems.app/account/api-tokens.
2. Click New token.
3. Fill in:
   • Name: what the token's for, so you can recognise it later (e.g., cli-laptop, ci-deploy). 1–64 characters.
   • Expiry: how long it's valid for, 1–365 days. Default is 90.
4. Click Create.

A dialog shows the plaintext token with a copy-to-clipboard button. Copy it now; close the dialog and it's gone.

Listing tokens

The API tokens page lists every token you've ever created. Per token:

• Name. What you called it.
• Created. When you minted it.
• Expires. When it stops working.
• Status. Active, Expired, or Revoked.

Revoked and expired tokens stay in the list (so you can see what was live when) but they're greyed out and can't be reactivated. To get a new token, create one. There's no per-token edit.

Revoking a token

Find the token in the list and click Revoke. The CLI on whichever machine was using that token will stop working immediately.

You'd revoke a token if:

• You lost the laptop it was on.
• A token leaked (committed to git by accident, pasted in a chat).
• You're rotating credentials for hygiene.

Revoking is one-way; there's no un-revoke. Mint a new token if you need to keep using that machine.

Using a token from the CLI

The simplest path is to let the CLI mint and store one for you:

zeon auth login                                   # browser flow, mints + stores
zeon auth login --token zat_aBc123…               # paste an existing one (skips browser)
zeon auth login --token zat_aBc123… --global      # write to ~/.zeon/.env instead of ./.env

If you want to set the token by hand, put it in an .env file or shell env:

export ZEON_API_TOKEN=zat_aBc123…
zeon project list

See zeon auth for the full set of CLI auth flags.

A few constraints

• You can't mint a token from another token. New token creation requires the browser session (cookie auth). This is a safety property: a leaked CLI token can't be used to mint more.
• A token has the same access as your account. There are no per-token scopes today. A token can read and write everything your user can, including creating new tokens (when used in conjunction with browser auth) and accessing every project you own.
• There is no limit on how many tokens you can hold. Mint one per machine or per script; revoke the ones you stop using.

Where to go next