[gregberge]

Important

Merge once argos-ci/argos#2747 is deployed. Until then, these docs describe a UI and API that don't exist in production yet.

The CLI parts (argos project token, argos account project-token, --project on baseline download) and ARGOS_PROJECT for multi-project tokens also need argos-ci/argos-javascript#411 released. If the SDK release lags behind the deploy, hold this PR until it ships.

Documents the project tokens shipped by argos-ci/argos#2747 (Linear ARG-519). A project can have several tokens, each hashed and shown once, with permissions and an optional expiration, so the old "copy it from Settings → Authentication → Project token" and "Regenerate token" instructions are wrong.

New page: Account & access → Project tokens

• What a token has: a name, linked projects, permissions, an expiration and a last-used date. It is shown once and can't be displayed again.
• Where tokens are managed: in Project settings → Authentication (reviewers see the list, project admins create, rename and revoke) and in Team Settings → Tokens (team owners manage every token, including multi-project ones). Personal accounts use Settings → Tokens.
• How to create a token, plus the Getting started Generate token button (Upload from CI, 90 days).
• Permissions: the presets (Upload from CI, Read only, Full access, Advanced) and the five individual permissions. Two cases need more than one preset gives: media upload (media:write) and argos baseline download (projects:read + builds:write). Also the 403 message.
• Expiration: 90 days by default; No expiration is discouraged and asks for confirmation. Also the expired-token error.
• Rotating without downtime: create the replacement, update the CI secret, revoke the old token once its last-used date stops moving.
• Multi-project tokens: need ARGOS_PROJECT=owner/project; a single-project token ignores it. Transfer behavior.
• Legacy tokens: keep every permission, never expire, and keep working. Last used shows "Never" until the next upload.
• API: GET/POST /projects/{owner}/{project}/tokens, DELETE …/tokens/{tokenId}, and GET/POST/DELETE /accounts/{accountSlug}/project-tokens, with the role each one requires. The create endpoints require expireAt (null for never), and default permissions to builds:write + deployments:write. The same operations are MCP tools.

Registered in docs/SUMMARY.md and in the Account & access README.

Updated mentions

• Quickstarts (9), migration guides (7), deployments (2): ARGOS_TOKEN now links to the new page and says to create the token in Settings → Authentication and copy it right away.
• Run Argos in CI: the Regenerate token steps are replaced with how to create a token, rotation, and the error messages. ARGOS_PROJECT is added to the env var table.
• CLI reference: read-only commands need Read only. baseline download needs Read projects + Upload builds and takes --project for a multi-project token. A project token identifies its project only when it is linked to a single project. New project token list|create|revoke and account project-token list|create|revoke sections, from feat: support project tokens linked to several projects, and rotate them from the CLI argos-javascript#411. Without flags, the CLI creates an upload-only token that never expires, so the docs say to pass --expires-in.
• Standalone media: each command lists the permission it needs. Upload from CI doesn't include the media permissions.
• AI agents (review builds, flaky tests), Security & compliance export: reading needs Read only / Read projects, not the default Upload from CI.
• API reference intro: where tokens are created and that they're shown once. Permissions limit what a token reaches.
• GitHub Actions auth, GitHub integration, account management, transfer, MCP server: links to the new page, wording for several tokens, and token tools.

To check before merging

• No SDK version is named for ARGOS_PROJECT or the token commands. Add one if you want it once feat: support project tokens linked to several projects, and rotate them from the CLI argos-javascript#411 is released.

🤖 Generated with Claude Code