# CI/CD & service tokens

Personal tokens are tied to one member and shouldn't be shared — for CI/CD, create a **service token** instead.

## Creating a service token

Only an org owner can create service tokens. Go to **Settings → API Tokens → Service tokens** and create one with a descriptive name (e.g. `CI deploy`). The raw token is shown once — copy it immediately.

## Using it in GitHub Actions

```yaml
- name: Authenticate with Publy
  run: dart pub token add https://publy.dev/o/your-org --env-var PUBLY_TOKEN
  env:
    PUBLY_TOKEN: ${{ secrets.PUBLY_TOKEN }}

- run: dart pub get
- run: dart pub publish --force
```

Store the raw token as a `PUBLY_TOKEN` repository secret in GitHub.

## Visibility

Service tokens are visible to every member of the org (so teammates can tell what CI/CD relies on), but only an owner can create or revoke one.