Skip to content
Docs · Sign-in and tokens

Reference

Sign-in and tokens

How agents, the CLI and scripts sign in to Stableship, what each token scope allows, and the rate limits.

Three ways to sign in

  • Browser sign-in (OAuth). Most coding agents and builders use it on their own: add the MCP server, and the tool opens app.stableship.ai for you to sign in, pick the workspace and approve. Stableship supports dynamic client registration and PKCE, and refresh tokens rotate. The connection gets every scope, with the same approvals for anything that lowers protection. Disconnect it in Settings, then Connections, then Connected apps.
  • Terminal sign-in. stableship login shows a code and opens app.stableship.ai to approve it, then saves a token for the CLI and the Claude Code plugin's hooks.
  • API tokens, for CI, scripts, and tools that cannot sign in through the browser.

API tokens

In Stableship open Settings, then Connections, open API tokens and connected apps, and choose Create token. Name it after where it will be used, and pick what it may do:

In the appScopeAllows
Read findings and rulesreadReading apps, releases, findings, fix briefs, rules and reports
Start checks and verify fixesrunAlso starting checks and audits, verifying fixes, adding product notes, and proposing rules and flows
Run StableshipmanageAlso acting for you in the app. Only owners and admins can make these.

A token acts with the role and app access of the person who made it. Someone limited to some apps gets tokens limited to those apps.

The token starts with sst_ and is shown once. Stableship keeps only a hash of it; the list shows its first characters, its scopes and when it was last used. Revoke it from the same list, and it stops working at once.

Keeping tokens safe

  • Give each agent and each CI job its own token, with only the scopes it needs.
  • Keep tokens in environment variables, your shell profile or CI secrets. Never commit one, and never paste one into an agent's chat.
  • Lost a token? Make a new one and revoke the old.

Rate limits

  • Every request: bursts of 60, then one a second.
  • Starting checks and audits: bursts of 10, then one a minute.

Past the limit, the API answers 429 with a retry-after header.

For your coding agent: this page as Markdown