Skip to Content
DocsDashboardKeys

Keys

Programs, CI jobs and other systems reach Cadence.CI with tokens. The Keys page, under Resources, lists them by kind, creates them, and revokes them.

Keys page: run tokens, artifact tokens and cluster tokens, each in a table, then the leaked token reports

Kinds of Keys

KindWho uses itCreated by
Run tokenCI jobs and programs that start runs and report them, and ask for machines. It goes in MELODIUM_API_TOKEN.Any member
Artifact tokenSystems outside Cadence.CI downloading artifacts, such as a deploy script or a package index. It reads artifacts and nothing else.Administrators
Cluster tokenA cluster you operate yourself, to register it (see Deploying Clusters).Administrators and Operators

Each kind has its section, with a table: the status of each token (Active, Expired or Revoked), its name, its hint, what it is for, when it was created and when it expires. For an artifact token, the Reads column says which artifacts it reads. Click a line to see the token’s details, and revoke it from there.

Other pages lead here: Get Cluster Token on the Clusters page and Get Artifact Token on the Storage page open this page with the form of that kind of token.

Creating a Token

  1. Click Create Token next to the kind you need.
  2. Give it a name, and what the form asks for that kind: a description and an expiry date for a run token; for an artifact token, the artifacts it reads (all of them, those of one run, or those whose name starts with a prefix) and its expiry, or none.
  3. Copy the token when it appears. It is shown only once: Cadence.CI keeps only its SHA-256 and a hint to recognize it.

The form of an artifact token, opened from Get Artifact Token

Keep the token in a secret store, such as the variables of your CI or a secret manager, never in a repository. If you lose it, create another one and revoke the lost one.

Cadence.CI shows each token by its hint, such as cad_r_...k3Pz: its prefix and last 4 characters. Compare it with the end of the token in your CI variables to know which one they hold.

Format

Every token has the form cad_<kind>_<random>_<checksum>:

  • cad: the prefix of Cadence.CI tokens;
  • <kind>: what the token is for;
  • <random>: 48 characters of 0-9A-Za-z, from a cryptographic random generator;
  • <checksum>: the CRC32 (IEEE) of cad_<kind>_<random>, written as 6 base62 digits, most significant first, with the alphabet 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz. It tells a token from a look-alike without calling Cadence.CI.
KindToken
ua member’s session in the dashboard
ra run token, with which CI jobs and programs start runs and report them
ca cluster token, registering a cluster you operate with Cadence.CI
vthe token of the machine executing a run, valid for that run only
ccthe token of a Clever Cloud add-on
bthe boot token of a run’s machine, valid 15 minutes and exchanged once, at boot, for its v token
aan artifact token, reading artifacts only
csa cache scope token, naming a scope in run requests; it authenticates nothing

This expression matches every Cadence.CI token, of present and future kinds:

\bcad_[a-z]{1,2}_[0-9A-Za-z]{48}_[0-9A-Za-z]{6}\b

Checking a Token

GET https://api.melodium.tech/0.1/token/check, with the token as bearer, answers 200 with its kind, such as {"kind": "run"}, when the token is live, and 401 otherwise. It changes nothing. Kinds are named user, run, cluster, machine, clever_cloud, bootstrap, artifact and cache_scope.

curl -H "Authorization: Bearer $TOKEN" https://api.melodium.tech/0.1/token/check

When a Token Leaks

Secret scanners recognize Cadence.CI tokens. When GitHub or GitLab find one in a public place, such as a repository, a package or CI logs, they report it to Cadence.CI, which revokes it at once:

  • a session: the member gets an email;
  • a run or cluster token: the administrators of the organization get an email naming the token and where it was found, as the jobs using it stop working until it is replaced;
  • the token of a run’s machine: the run is warned, and the administrators get an email;
  • a Clever Cloud add-on token, the boot token of a run’s machine, or an artifact token: the administrators get an email.

On the Keys page, a revoked token says it leaked, under its line in the table, with a link to its report and a button to create a replacement. Administrators see every report in Leaked token reports, at the bottom of the page: the token’s kind and hint, who reported it, where it was found, when, and what was done.

Anyone who finds a token can have it revoked, with up to 100 tokens at once:

curl -X POST https://api.melodium.tech/0.1/token/revoke \
    -H "Content-Type: application/json" \
    -d '{"tokens": ["cad_r_..."]}'

The answer is always 202, whether the tokens existed or not.

Both endpoints are limited to 120 requests a minute per address.

Tokens from Before the Format

Tokens created before 2026-10-16 have no cad_ prefix, so secret scanners cannot recognize them. Their hint starts with ... on the Keys page. They are accepted until 2027-01-31 included, and refused from 2027-02-01: replace them before.

Going Further

StorageSecrets