Developers · CLI
Replacing a CLI Access Token
Last updated 1 November 2026
Take a new Insites CLI access token when one is exposed or expiring; the old one stops working at once.
An access token lets the Insites CLI, or a script, reach one instance in your name. Every change made with it is recorded against you. If a token may have been exposed, or it has expired, take a new one. The old token stops working at once.
Note
Most people sign the CLI in through the Insites Console and never need a token. Tokens are for environments added with a token, such as CI jobs or a machine where a browser sign-in is not possible.
How tokens work
| Rule | What it means |
|---|---|
| One token per person per instance | Taking a new token replaces your old one immediately |
| Edit role or higher | You need at least the edit role on the instance to take a token |
| Expires after 90 days | Take a new one before then, or the CLI stops signing in |
| Shown once | The Console shows the token only when you take it. It stores a hash, never the token |
| Your own only | You take a token for yourself. Admins can see and revoke the tokens of everyone on the instance; everyone else sees only their own |
| Private stack instances | Tokens work only for instances on the Insites private stack |
Take a new token
- Sign in to the Insites Console and open the instance.
- Open its CLI tab and take a new access token.
- Copy the command the Console shows. It adds the environment with the proxy address and the new token.
insites-cli env add staging --url <proxy URL> --token iak_...Tokens start with iak_. Requests made with one go through the Insites proxy, which checks your role on every request.
Check it worked
insites-cli doctordoctor checks each environment's sign-in and whether the instance accepts it. It never prints a key or token.
Common mistakes
- Keeping the old token in a CI secret after taking a new one. The old one stopped working when you took the new one; update the secret.
- Sharing one token between people. A token belongs to one person, so the record of who changed what would be wrong.
- Pasting a token into a file you commit. Keep it in a secret store or an environment variable.