Development tokens

A development token lets a developer run the workspace interface on their own computer against the live workspace, signed in as themselves. It is for building your own front end; nothing else needs one.

Creating one

1. Open Connected in the sidebar.
2. In the Development section, press Create token.
3. Copy the three lines shown. The token is shown once; close the box and it is gone. If you lose it, revoke it and create another.

Paste the lines into a terminal in your repository, then start the app:

export API_PROXY_TARGET=https://<workspace>.jourier.dev
export JOURIER_DEV_TOKEN=jdt_...
npm run dev

What it is

• It is you. Every call carries your permissions and nothing more. An external member’s token sees what that member sees.
• It works on /api only. Signing in, signing out and managing tokens need a real sign-in in the browser.
• It lasts thirty days. After that, create a new one.
• Three can be live per person. Revoke one to make room.
• It ends with your membership. When you are removed from the workspace, your tokens stop working within five minutes.
• Every use is dated; the Development section shows when each token was last used.

Revoking

Press Revoke next to the token. Yours are listed for you; an admin sees everyone’s and can revoke any of them. A revoked token stops at once.

Keeping it safe

• Never paste a token into a chat, a ticket, an e-mail or a commit. Set it as an environment variable in your own terminal, as above.
• A .env file is fine on your own computer; the seed’s .gitignore keeps .env files out of the repository. Never remove that line.
• If a token may have leaked, revoke it. Creating a new one takes seconds.