API tokens and programmatic access

Overview

API tokens provide programmatic access to the VibeView REST API. Use them to upload apps, retrieve session data, or generate reports from CI/CD pipelines and scripts.

Features

• Token list — A table showing all tokens for your organisation with columns for label, masked token prefix, access (Full access or CI only), status (when it was last used, never used, or expired), expiry date, creator email, and assigned role.
• Token creation — Organisation admins can generate new tokens with a custom label, a role (Developer or Admin), an access level (Full access or CI only) and an expiry (30 days, 90 days, 1 year or never).
• One-time display — The full token value is shown exactly once at creation time. It cannot be retrieved later.
• Token deletion — Remove tokens that are no longer needed. Any integration using a deleted token will immediately lose access.

How to create a token

Creating (and deleting) tokens requires the Admin role.

1. Navigate to Settings > API token.
2. Click Generate API token.
3. Enter a descriptive Label (e.g., “CI Pipeline” or “Staging Deploy”).
4. Select a Role for the token — this determines what API endpoints the token can access.
   • Developer — Can manage apps, view sessions, and run tests.
   • Admin — Full access including billing and team management endpoints.
5. Choose the token’s Access:
   • Full access — The token can call every endpoint its role allows.
   • CI only — The token can do only what a CI pipeline needs (see CI-only tokens).
6. Choose when the token Expires: 30 days, 90 days, 1 year or Never.
7. Click Generate token.
8. Copy the displayed token immediately — it will not be shown again. Above it, the dialog restates the token’s label, access and expiry date.
9. Click Copy token to place it on your clipboard.
10. Store it where it will be used. For a CI-only token, add it to the repository as the secret VIBEVIEW_API_TOKEN, which the CLI reads (see CI testing).

CI-only tokens

For a CI pipeline, create one CI only token per repository, with an expiry, and store it only as that repository’s secret. If the secret leaks, the token can’t be used to manage your team, billing, build secrets, signing credentials, webhooks or other tokens, or to open live device sessions.

A CI-only token can:

• upload an app build (vibeview upload-app) and read your apps and their builds (vibeview list-builds);
• start, follow, cancel and download cloud builds (vibeview build --cloud, vibeview builds);
• create or update a test case from a spec (vibeview create-test);
• list groups and start test, group and tagged-group runs (vibeview list-suites, run-test, run-suite, run-suites);
• read a run’s status and results, including its step screenshots, and cancel a run it started;
• list devices (vibeview list-devices) and check who it is (vibeview whoami).

A CI-only token can end only the device sessions its own test and group runs started. It can’t end your other sessions, or, even with the Admin role, anyone else’s.

To revoke a CI-only token, delete it on this page (see How to delete a token). vibeview logout doesn’t revoke a token that the CLI reads from VIBEVIEW_API_TOKEN.

Anything else is refused with a 403 error that says the token has the ci scope. The token’s Role still applies on top: a CI-only token with the Developer role can do only what a Developer can do among the actions above. Starting or cancelling a test or group run needs the Developer role, so a token with the Viewer role, or one whose creator is now a Viewer, can’t start runs.

Token expiry

A token with an expiry stops working at the end of the chosen period. A request made with an expired token is refused with a 401 error that says when the token expired; the token list shows it as expired. Expiry can’t be extended: create a new token, update the secret that holds it, and delete the old one.

Tokens created without an expiry, including every token created before expiry was available, keep working until you delete them, and keep full access.

How to delete a token

1. In the token table, click the trash icon on the row of the token you want to remove.
2. A confirmation dialog warns that integrations using this token will stop working.
3. Click Delete token to confirm.

Permissions