All sections

API tokens

1 min readValidated September 27, 2026

The CLI uses the token from kraftify login. Anything else that needs to talk to the API, a CI job or a small script, should use a scoped token instead of your password.

Create one #

kraftify tokens create ci --scope targets:read --scope targets:write

The token is printed once. There is no way to read it back, only to revoke it.

Scopes #

Scope	Grants
targets:read	List targets, read status, the ceiling and logs
targets:write	Create, start, stop and delete targets. The scope that spends money
env:read	See which env keys are set, and which have changed
env:write	Record that a value is set. You need the value in hand already
domains:write	Add domains and change records
tokens:write	Create and revoke tokens

A token with tokens:write can mint more tokens. Treat it as full access and keep it out of shared config, and out of any agent's reach: a deploy tool that can create credentials can outlive the session that gave it to them.

Scopes stack with the ceiling rather than replacing it. A token with targets:write can still be refused by a create that would cross the account's monthly cap.

Use it #

export KRAFTIFY_TOKEN=kf_...
kraftify status --token "$KRAFTIFY_TOKEN"

Revoke #

kraftify tokens revoke ci