API Tokens

API tokens provide programmatic access to the gateway for CI/CD pipelines and automation.

Viewing Tokens

Navigate to API Tokens in the sidebar to see your tokens (admins see every token):

Column	Description
Token ID	Public UUID for the token
Name	Descriptive name
Status	Active or expired (tokens created with an expiry time)
Created By	User who created the token
Last Used	Most recent API call using this token
Created	When the token was created

Click Create Token
Enter a descriptive name
Choose permissions (or use a role shortcut like Viewer, Ops, Deployer, CI/CD, Admin). You can only choose permissions your own role has.
Click Create Token and complete the MFA prompt
Copy the token secret immediately, then click Done

Tokens created in the web UI don’t expire. To set an expiry, create the token with rack-gateway api-token create --expires-at <RFC3339 time>.

Tokens are prefixed with rgw_:

The token string does not encode the role; permissions are stored server-side. The gateway stores only a hash of the secret.

export RACK_GATEWAY_API_TOKEN="rgw_..."
export RACK_GATEWAY_URL="https://gateway.example.com"

rack-gateway apps
rack-gateway deploy -a myapp

curl -H "Authorization: Bearer rgw_..." \
  https://gateway.example.com/api/v1/rack-proxy/apps

Edit lets the token’s owner (if they are a deployer) or an admin update the name and permissions. New permissions must still be within the owner’s role.
Delete Token permanently removes the token.

Both need a fresh MFA check.