What happens to my old tokens?

They keep working as full tokens with no end date. Make scoped ones and revoke the old ones when you are ready.

Can a read only token run check?

Yes. check reads the file on your computer and only asks which plan the token has.

Can my AI assistant restore a build?

Yes, with restore_build and a confirmation. It can also list webhooks, without their URLs or secrets.

Tokens that can do only what they need

Pro and Team

A CI job that uploads builds does not need to delete them, and a status dashboard does not need to upload. With one kind of token, every place that holds it can do everything your role allows, and it never expires.

Now each token has a scope and, if you want, an end date. Read only tokens list and read; upload tokens also upload; full tokens do everything your role allows, as before.

Start free See plans

Example

API tokens

GitHub ActionsUpload, ends Feb 7, 2027, used today
Release dashboardRead only, no end date
LaptopFull, used 3 days ago

Tokens made before November 9, 2026 are full with no end date.

Made for

Teams with several pipelines and scripts holding tokens
Developers who hand a token to a contractor or a tool for a while
Anyone who wants to manage tokens and webhooks without the dashboard

What it ends

One all powerful token copied into every CI secret
Old tokens nobody remembers, still working
Opening the dashboard to restore a build or resend a webhook

How it works

Step 1
Pick a scope
In Settings, API tokens, or with appforshare tokens create <name> --upload-only or --read-only from a full token. The token is printed once.
Step 2
Set an end date
Optional: 1 to 365 days. An expired token answers with its end date.
Step 3
Check what is in use
appforshare whoami shows the token's name, scope, end date and last use.

What each scope can do

Read only: GET calls and check. Upload: reads plus uploads, including resumable uploads, the Diawi and Pgyer compatible uploads and uploads from a URL. Full: everything your role allows, the default. Making and revoking tokens needs a full token. With the MCP server, a read only token lists only the read only tools, and an upload token adds the upload tools.

More from the CLI

appforshare restore brings back a build deleted in the last 7 days; with no argument it lists them. appforshare webhooks lists your webhooks, sends a test, shows the last deliveries and sends one again (Owner and Admin). Adding a webhook stays in the dashboard, where its URL and secret are pasted, and no command prints them.

A new webhook event, link.expiring, fires once 24 hours before an install link stops: a Free link reaching its end, a paid extension ending, or a stop date on a build or one of its extra links. Slack, Microsoft Teams, Google Chat and Discord get a card.

Good to know

No MCP tool makes tokens or adds webhooks, by design: those secrets stay out of chats.
Scopes limit what a token can do; the token still acts with its owner's role in the workspace.
Telegram does not get the link.expiring event.

Questions

What happens to my old tokens?: They keep working as full tokens with no end date. Make scoped ones and revoke the old ones when you are ready.
Can a read only token run check?: Yes. check reads the file on your computer and only asks which plan the token has.
Can my AI assistant restore a build?: Yes, with restore_build and a confirmation. It can also list webhooks, without their URLs or secrets.