Tokens and automation

Handle CLI, CI, and MCP credentials safely.

Use epismo login interactively. For CI/CD, issue a workspace-scoped token and inject it from a secret manager as EPISMO_TOKEN.

epismo token create --workspace-id <workspace-id>
EPISMO_TOKEN=<access-token> epismo whoami

When EPISMO_TOKEN exists, its workspace replaces the saved default. Verify identity and context with whoami at job startup.

Do not type tokens into shell history or include them in Definitions, Records, artifacts, or error reports. Revoke and replace suspected credentials with epismo token list to find the token id and epismo token revoke <token-id> to kill it. Do not share one token between a personal machine and CI.