Tokens

Create, list, revoke and rotate your account tokens (gh_…) from the terminal — the same tokens the dashboard shows under Settings → API Tokens.

ghayma token create

# A deploy token that expires in 90 days (the defaults)
ghayma token create ci
 
# More scopes, restricted to two projects
ghayma token create throct-crm --scope deploy,databases --project acme --project acme-api
 
# A token that never expires
ghayma token create backup-job --scope databases --expires 0

Options:

The secret is printed once, when the token is created. Save it right away — it is never shown again.

ghayma token list

ghayma token list
ghayma token list --all

Lists your tokens with their prefix, name, scope, projects, expiry, last use and creation date. Revoked tokens are hidden unless you pass --all. --json prints the list as JSON.

ghayma token revoke

ghayma token revoke ci

Takes a token’s id, prefix or name, as long as it matches exactly one token. The token stops working at once; its history stays. The CLI asks for confirmation unless you pass --yes. For the token the CLI itself is logged in with, it first warns that you will have to run ghayma login again, and without --yes asks a second time.

ghayma token rotate

ghayma token rotate throct-crm
ghayma token rotate throct-crm --expires 90

Takes an id, prefix or name. Mints a replacement with the same name, scope and projects, revokes the old token, and prints the new secret once. --expires sets a new lifetime in days; without it the replacement keeps the old token’s remaining lifetime. --json prints the result as JSON.

Rotating the CLI’s own login token updates the CLI’s config in place, so you stay logged in.