Automation Credentials | Ghostable CLI 3.x | Ghostable Menu Automation Credentials Create a credential ------------------- Create the credential from an owner device and grant only the environments and roles the job needs: Create CI and deploy credentials Copy ``` $ ghostable access create --name github-actions --kind ci --grant staging:reader $ ghostable access create --name production-deploy --kind deploy --grant production:reader ``` Kinds are `ci`, `deploy`, and `access`. They label intended use; effective access comes from the environment grants. Automation grants accept only `reader` or `writer`. Store the token --------------- The command returns a credential token and writes its public device and grant records under `.ghostable/`. The token embeds that automation identity's private keys, is shown only once, cannot be recovered from the committed records, and has no built-in expiration. Store it immediately in the CI or deployment platform's encrypted secret store as `GHOSTABLE_CI_TOKEN`, then commit the repository changes. The token is a secret Never commit the token, place it in a deployment script, echo it in logs, or pass it as a CLI argument. Anyone holding it can exercise the grants encoded for that automation identity. Use the credential ------------------ Ghostable automatically loads the token from the environment: POSIX shells Copy ``` $ export GHOSTABLE_CI_TOKEN="" $ ghostable validate --env staging --json $ ghostable deploy production --dry-run --json ``` PowerShell Copy ``` $ $env:GHOSTABLE_CI_TOKEN = "" $ ghostable validate --env staging --json $ ghostable deploy production --dry-run --json ``` Automation credentials bypass local biometric or user-presence prompts because no user session exists. Their security therefore depends on token storage, runner isolation, and narrow grants. Scope and permissions --------------------- - Use `reader` for validation, tests, process injection, and deployments that only read Ghostable state. - Use `writer` only when the job must commit new encrypted values or metadata. - Create separate credentials for CI and production deployment so either one can be revoked independently. - Do not grant production to preview or pull-request jobs. Revoke and replace ------------------ Automation credentials appear as devices in access views. Revoke the credential's device ID and commit the signed policy change: Revoke automation Copy ``` $ ghostable access list --full $ ghostable access revoke --device-id --env all ``` Revocation permanently disables that automation identity and automatically rotates affected environment keys. Delete the old platform secret, create and store a new credential, commit its public records, and update the job before removing the old secret. If compromise is possible, also rotate any database passwords, API keys, or provider credentials the automation identity could have decrypted; environment-key rotation only protects future Ghostable ciphertext. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) CLI 3.x [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found