Access Tokens

Learn how to create, manage, and use Personal Access Tokens (PATs) to authenticate with DepAegis across npm, NuGet, Docker, and CI/CD pipelines.

What Are Access Tokens?

Access tokens (also called Personal Access Tokens or PATs) are long-lived authentication credentials that replace passwords in automated workflows. Instead of typing your password every time you publish a package or push a container image, you create a token and use it in your tool configuration.

DepAegis tokens are prefixed with dap_ (e.g. dap_abc123def456...) and can be scoped to specific permissions and organizations.

Creating Tokens in the Dashboard

1. Open the DepAegis dashboard and navigate to Settings → Access Tokens.
2. Click New Token.
3. Fill in the token details:
   • Name — a descriptive label (e.g. npm-ci, docker-dev).
   • Scope — the permission level (see below).
   • Expiration — when the token expires.
   • Organization (optional) — restrict to a specific organization.
4. Click Create and copy the token value immediately. It will not be shown again.

Token Scopes

Scopes control what a token can do. Choose the narrowest scope that satisfies your use case:

Token Expiration Settings

Every token has an expiration date. DepAegis supports the following expiration options:

• 30 days — for short-lived CI tokens
• 90 days — for developer workstations
• 1 year — for long-lived automation
• Custom — any date up to 2 years in the future
• Never — tokens without expiration (not recommended)

Using Tokens with npm

Configure your .npmrc file to use a DepAegis token for authentication. The token goes in the _authToken field:

Environment variable (recommended)

//app.depaegis.com/:_authToken=${DEPAEGIS_TOKEN}

Set the DEPAEGIS_TOKEN environment variable in your shell or CI configuration. This keeps the token out of your source tree entirely.

Hardcoded token

//app.depaegis.com/:_authToken=dap_abc123def456...

For full npm setup instructions, see the Configuring npm guide.

Using Tokens with NuGet

Pass the token as the --api-key when pushing packages:

dotnet nuget push MyPackage.1.0.0.nupkg \
  --source "https://app.depaegis.com/api/v1/nuget/v3/index.json" \
  --api-key "dap_abc123def456..."

To avoid passing the key on the command line, store it with dotnet nuget setapikey:

dotnet nuget setapikey "dap_abc123def456..." \
  --source "DepAegis"

Or configure it in nuget.config using environment variable substitution:

<packageSourceCredentials>
  <DepAegis>
    <add key="Username" value="token" />
    <add key="ClearTextPassword" value="%DEPAEGIS_TOKEN%" />
  </DepAegis>
</packageSourceCredentials>

For full NuGet setup instructions, see the Configuring NuGet guide.

Using Tokens with Docker

Authenticate Docker against the DepAegis container registry using a token as the password:

echo "dap_abc123def456..." | \
  docker login app.depaegis.com -u your-username --password-stdin

You can also use the token directly (less secure — visible in shell history):

docker login app.depaegis.com -u your-username -p "dap_abc123def456..."

For full Docker setup instructions, see the Configuring Docker guide.

Using Tokens in CI/CD

In automated pipelines, store the token as a secret environment variable and reference it in your tool configuration. Here are patterns for common CI/CD platforms:

GitHub Actions

# Store DEPAEGIS_TOKEN as a repository secret
# Settings → Secrets and variables → Actions → New repository secret

- name: Publish npm package
  run: npm publish
  env:
    DEPAEGIS_TOKEN: ${{ secrets.DEPAEGIS_TOKEN }}

- name: Push Docker image
  run: |
    echo "${{ secrets.DEPAEGIS_TOKEN }}" | \
      docker login app.depaegis.com -u "${{ secrets.DEPAEGIS_USERNAME }}" --password-stdin
    docker push app.depaegis.com/my-org/my-app:${{ github.sha }}

GitLab CI

# Store DEPAEGIS_TOKEN as a CI/CD variable
# Settings → CI/CD → Variables

publish:
  stage: deploy
  script:
    - npm publish
  variables:
    DEPAEGIS_TOKEN: $DEPAEGIS_TOKEN

Azure DevOps

# Store DEPAEGIS_TOKEN as a pipeline variable (secret)
# Pipelines → Library → Variable groups

- task: NuGetCommand@2
  inputs:
    command: push
    publishFeedCredentials: DepAegis
  env:
    DEPAEGIS_TOKEN: $(DEPAEGIS_TOKEN)

Token Rotation Best Practices

Regularly rotating tokens limits the damage window if a token is leaked. Follow these guidelines:

1. Set explicit expiration dates on every token (30–90 days for CI, 90–365 days for workstations).
2. Create a replacement token before the current one expires. Update all references, then revoke the old token.
3. Use separate tokens per environment — one for CI, one for development, one for production. This limits blast radius if one is compromised.
4. Audit token usage — review the Settings → Access Tokens page periodically to identify unused or stale tokens.

Revoking Tokens

If a token is compromised, revoke it immediately:

1. Navigate to Settings → Access Tokens.
2. Find the token in the list.
3. Click Revoke (or the trash icon).

Revocation is instant — all API calls using the revoked token will return 401 Unauthorized within seconds.

Via REST API

curl -X DELETE \
  -H "Authorization: Bearer $DEPAEGIS_ADMIN_TOKEN" \
  "https://app.depaegis.com/api/v1/tokens/dap_abc123def456..."

Security Best Practices

• Never commit tokens to version control. Use environment variables, secrets managers, or CI/CD secret stores. Add .npmrc, nuget.config, and config.json with real tokens to .gitignore.
• Use the narrowest scope possible. A read-only token is sufficient for restoring packages in production. Reserve write and admin tokens for publishing and administration.
• Rotate tokens regularly.Even if a token hasn't been compromised, rotating it limits the window of exposure.
• Name tokens descriptively. Use names like github-actions-publish or dev-laptop-jane so you can quickly identify which token to revoke if needed.
• Audit token usage. Check the DepAegis audit log for unusual activity — unexpected publishes, pulls from unknown IPs, or usage outside normal hours.
• Revoke unused tokens. Delete tokens you no longer need. Each active token is an attack surface.