CLI access

Scoped tokens for machines. People sign in through the browser; build agents use a token an admin issued and can revoke.

When you need a token

Not for everyday use. A person running the CLI on their laptop just runs secureai login. The browser flow gives them a session tied to their own identity, which is better for audit than a shared secret.

Issue a token when there is no browser and no person:

CI pipelines running scans on pull requests.
Scheduled adversarial testing against staging.
Automation that generates reports on a cadence.

Issuing one

Open CLI Access in the admin navigation.
Choose Grant access.
Pick the user it acts as, and scope it to a project, model, and environment.
The token is shown once. Copy it straight into your secret store.

The token is displayed once

It is not recoverable afterwards. The list only ever shows the last four characters. Lose it and you rotate, which is by design: a token you can re-read is a token anyone with dashboard access can re-read.

Scoping

Dimension	Why it matters
User	The identity actions are attributed to in audit logs.
Project	Confines the token to one product or team.
Model	Narrows it to a single system.
Environment	Keeps a staging pipeline out of production.

Issue one token per pipeline. A single token shared across every repository cannot be revoked without breaking all of them, which in practice means it never gets revoked.

Using it

Expose the token as SECUREAI_TOKEN. It takes precedence over any stored session, so a runner with a cached credentials file still uses what the pipeline supplied.

GitHub Actions

- name: Scan prompts
  env:
    SECUREAI_SERVER: https://api.corelayersecurity.com
    SECUREAI_TOKEN: ${{ secrets.SECUREAI_TOKEN }}
  run: secureai scan ./prompts --fail-on high

Full pipeline examples are on CI integration.

Rotating

Rotate token issues a new value and invalidates the old one immediately. Update your secret store in the same change. Anything still using the old token starts failing with exit code 2 as soon as you rotate.

Rotate when

Someone with access to the secret leaves.
A token may have been exposed in a log, screenshot, or commit.
On whatever schedule your organisation requires.

Revoking

Revoke invalidates the token permanently. It takes effect immediately and cannot be undone. To restore access, grant a new token.

Removing a user does not revoke their tokens

Tokens are separate objects with their own scope. Offboarding means removing the account and revoking the tokens issued under it. The checklist is on Managing users.

Monitoring use

CLI Activity shows what has actually been run: which command, against which model, by which identity, and when. Admins and security researchers see the whole organisation; developers see their own; executives see a summary.

Worth watching for:

A token running commands outside the scope it was issued for.
Activity from a pipeline that should be idle.
A token still in use after the person it belongs to has left.

Tokens and the payload corpus

The adversarial payloads used by secureai test are not in the CLI binary. They are fetched from the control plane per run, over an authenticated request, and served only to developers and security researchers. A token scoped to a role without that access can still scan and validate, but cannot pull the corpus.

This is why the CLI can be distributed openly: a copied binary carries no attack content, and without a valid token it cannot obtain any.