Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Understanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifyPersonal access tokensManage personal access tokensSet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notificationsSet up Slack webhook notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding CI workflowsUnderstanding custom actionsCreate a build workflowCreate a custom actionCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
View pending approval tasks in your inboxMonitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate CyberArk Conjur secrets
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceEnable secret modeConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysFlag implementation reference
Backend SDK referenceGo SDK referenceJava SDK referencePython SDK referenceRuby SDK referencePHP SDK reference.NET/C# (server-side) SDK referenceNode.js SDK referenceMobile SDK referenceAndroid SDK referenceiOS/tvOS SDK referenceObjective-C SDK referenceSwift SDK referenceReact Native SDK referenceWeb SDK referenceJavaScript (browser) SDK referenceJavaScript SSR SDK referenceClient SDK referenceJava client SDK reference.NET/C# (client-side) SDK referenceC (server-side) SDK referenceC++ (server-side) SDK referenceC (client-side) SDK referenceC++ client SDK reference

Personal access tokens

2 minute read
Explanation— Understanding-oriented: why it works the way it does.

Personal access tokens (PATs) are general-purpose API credentials that allow external tools, scripts, and integrations to authenticate with CloudBees Unify on your behalf. PATs are not limited to a specific feature — any CloudBees Unify API operation that requires authentication accepts a PAT.

What personal access tokens are

A personal access token is a time-limited credential that represents your identity to the CloudBees Unify API. When you include a PAT in an API request, CloudBees Unify treats the request as if you made it directly, with the same permissions your account has.

PATs are distinct from your account password:

  • Your sign-in credentials authenticate you to the CloudBees Unify UI.

  • A PAT authenticates an external tool or script to the CloudBees Unify API.

This separation means you can grant API access to a tool without sharing your password, and you can revoke that access at any time by deleting the token.

How personal access tokens work

Every PAT has a fixed expiration date set at generation time. After a token expires, any tool using it loses access until you generate a new token and update the tool’s configuration.

When a token is generated, CloudBees Unify displays the token value once. After you leave the generation screen, the value cannot be retrieved — only the token name, description, and expiration date remain visible.

Why tokens instead of passwords

PATs offer several security advantages over account passwords:

  • Revocability — deleting a token immediately cuts off access without changing your password or affecting other integrations.

  • Isolation — separate tokens per tool let you revoke one integration without disrupting others.

  • Expiration — tokens expire automatically, limiting the window of exposure if a token is leaked.

Security model

Token lifecycle

Tokens expire on the date set at generation. There is no automatic renewal — when a token expires, integrations using it stop working until you generate a replacement. Use the minimum duration that meets your needs: short-lived tokens reduce exposure if leaked.

Secure storage

Treat a PAT with the same care as a password:

  • Store tokens in a secrets manager or your CI system’s secret store; never commit tokens to source control.

  • Use separate tokens for each tool or environment so that revoking one token does not affect others.

  • Rotate tokens before they expire to maintain continuous access without an outage.

Access control

A PAT carries the full permissions of the account that generated it, across all CloudBees Unify organizations that account belongs to. If your account has broad access in CloudBees Unify, your PAT has the same broad access. If your account is removed from an organization, tokens generated by that account lose access to that organization automatically.

Understanding authentication in CloudBees Unify
Manage personal access tokens