Authentication and credential reference
| Workflow | Credential |
|---|---|
| Interactive terminal | Browser-approved rvs auth login session in your secure credential store |
| Personal automation | Personal-account PAT, starting with rvs_ust |
| Automation acting as an organization member | Organization-account PAT, starting with rvs_uot |
| Shared organization CI | Organization-owned automation token, starting with rvs_oat |
| Native package tools | Temporary credential supplied by rvs, starting with rvs_slt |
| Browser package transfers | Separate temporary authorized transfer |
Each prefixed token has 50 characters: a seven-character marker immediately followed by 43 random characters. The marker identifies its category, not its account, permissions, or lifetime. Treat every complete value as a secret. Other session and browser credentials have separate formats and cannot be substituted for these tokens.
See Automation tokens for ownership, scopes, and direct-registry policy.
Generate a short-lived token
Section titled “Generate a short-lived token”The rvs package wrappers handle credentials automatically. For a client that needs a manually supplied temporary credential, run:
rvs artifacts auth print-token --target namespace/repository --kind pypi --access read --duration 4hChoose the matching registry kind and read or publish access. The command uses your stored login or the automation credential supplied through RVS_TOKEN. Organization members can use their browser-approved CLI session; a PAT is not required.
The default lifetime is four hours; supported durations are 15 minutes to 12 hours. Standard output contains only the secret. Add --json for the token and its expiry metadata. Protect the output from shell history, CI logs, and recordings. The dashboard also offers temporary-token generation.
Temporary credentials are restricted to the selected repository or private mirror, registry kind, and access. They cannot outlive their source authorization. The current wrappers use a four-hour credential for a package-tool invocation; they do not renew credentials inside an already running native process. Generate a fresh credential for a later invocation.
Session storage and precedence
Section titled “Session storage and precedence”rvs auth login defaults to a 180-day device session. The CLI refreshes short access credentials as needed and uses an operating-system keyring, an initialized pass store, or an encrypted vault. Plaintext fallback requires explicit acknowledgement. Inspect available storage with rvs auth storage doctor.
RVS_TOKEN accepts one of the three automation-token types and overrides the stored session, including when its value is invalid. It does not accept a short-lived native token. Keep interactive terminals free of this variable when using browser login.
Revoke unrecognized sessions in account settings. Token secrets are shown only at creation or rotation; they cannot be recovered later.