# ry tokens

> API tokens for CI (org-scoped).

```text
ry tokens [options] [command]
```

## Subcommands

### `ry tokens list`

Your tokens, without their value.

```text
ry tokens list [options]
```

Example:

```bash
ry tokens list
```

### `ry tokens create`

Create a token; prints its value exactly once.

```text
ry tokens create [options] <name>
```

Options:

- `--scope <scope>`: Narrow the token, repeatable: read | mail:send | `mail:send:<domain>` | deploy | `deploy:<app>` (without it: full access to the org).
- `--deploy <app>`: Short for --scope `deploy:<app>` (repeatable): deploy an existing app, nothing else.
- `--expires-in <duration>`: The token stops working after this long: 12h, 30d, up to 365d (default: never).
- `--expires-at <time>`: The token stops working at this moment, ISO 8601 UTC, e.g. 2027-01-31T00:00:00Z.
- `--agent <class>`: An agent token for a coding agent: sandbox, twin or production (production may only read).
- `--app <name>`: With --agent: an app the token may touch (repeatable; without it the whole org).
- `--read-prod-data`: With --agent production: may also read what production holds (database, files) - off by default.

Example:

```bash
ry tokens create ci-deploy --scope deploy:web --expires-in 30d
ry tokens create claude-code --agent sandbox --app web
```

### `ry tokens revoke`

Revoke a token; requests already using it are rejected right away.

```text
ry tokens revoke [options] <id>
```

Options:

- `-y, --yes`: Skip confirmation (required for automation).

Example:

```bash
ry tokens revoke tok-1a2b3c4d
```