What is a service token?

A service token is a credential issued to software rather than to a person, typically a CI pipeline or a script, that lets it authenticate to a service and read only what it has been granted.

What makes a service token safer

Service tokens tend to sit in CI settings for months and get copied between projects. A safer token is:

• narrow: one pipeline, one purpose, only the data that job needs;
• time-limited: it stops working after a set period;
• use-limited: it stops after a set number of sign-ins;
• bound to context: it works only from known networks, or only inside a specific CI job;
• revocable: an admin can cut it off at any time.

The OWASP Secrets Management Cheat Sheet recommends dedicated, least-privilege identities for pipelines and keeping high-value long-lived secrets out of CI tooling.

Service tokens in Crunu

A Crunu service token starts with crunu_svc_. It is created entirely in the admin's browser and shown once. The server knows only its public keys, so it cannot show the token again or recover a lost one.

When creating a token you choose:

• which environments it receives, for example web-app / staging and nothing else;
• a lease, an inactivity window: a token unused for longer than that stops signing in until an admin resumes it;
• a usage limit, from 1 to 1,000,000 sign-ins, or none;
• the networks it may connect from;
• a CI binding (OIDC), so the token works only together with a matching JWT from GitHub Actions, GitLab CI, Bitbucket Pipelines or another OIDC issuer.

In the pipeline, the token is stored in the CI's protected variables as CRUNU_TOKEN. crunu run signs in with it, checks signatures, decrypts in memory and starts your command:

crunu run --env web-app/staging -- npm test

crunu run never passes CRUNU_TOKEN or its other credential variables to the command it starts. A token for development or staging never receives the production key, so even a leaked one cannot decrypt production. For production, the recommended setup keeps secrets out of CI entirely: a machine with the agent fetches them, and the pipeline only restarts the service.

When a token leaks

Revoke it under Machines and tokens, rotate the keys of the environments it received, and reissue the values inside them at the providers. Rotation protects future versions; values the token already fetched stay valid until they are reissued. See service tokens and any CI with a service token.

Sources

• OWASP Secrets Management Cheat Sheet, checked October 27, 2026.