Tokens and automation

Handle CLI, CI, and MCP credentials safely.

Use epismo login interactively. For CI/CD, issue a workspace-scoped token and inject it from a secret manager as EPISMO_TOKEN.

epismo token create --workspace-id <workspace-id>
EPISMO_TOKEN=<access-token> epismo whoami

When EPISMO_TOKEN exists, its workspace replaces the saved default. Verify identity and context with whoami at job startup.

Do not type tokens into shell history or include them in Definitions, records, artifacts, or error reports. Revoke and replace suspected credentials with epismo token list to find the token id and epismo token revoke <token-id> to kill it. Do not share one token between a personal machine and CI.

Issuing new CLI or MCP credentials requires a live, write-capable first-party CLI login with offline access. Issued credentials cannot issue further credentials. Revoking the parent login connection also revokes its derived credentials and refresh chains. Required workspace SSO applies to derived credentials; its absolute 12-hour evidence deadline is not extended by issuance or refresh.