Access & safety
Practices for API tokens, sessions, and screenshots. Organization SSO and sealed secrets for workspace environments are covered in product-specific guides (for example Performance → Access & secrets).
API tokens
| Practice | Why |
|---|---|
| Least privilege | Start from Read-only or Custom; add write only where needed |
| Short expiry | Prefer 30–90 days for laptops; rotate CI tokens on schedule |
| Workspace restriction | Pin CI tokens to the target workspace |
| One token per runner | Revoke a single pipeline without breaking your laptop |
| Never commit tokens | Use CI secret stores; scan repos for sl_ leaks |
| Revoke promptly | Lost laptop, departed teammate, or exposed log → Revoke |
Screenshot and screen-share hygiene
Guide screenshots and demos should use:
- Demo labels (
cli,ci-staging) — not production names with customer data - Tokens that are already revoked or fake (
sl_demo…in prose) - Cropped reveals — never share a live
sl_…in Slack or tickets
When capturing your own docs, follow docs/guides/tools/capture-account-shots.mjs — it collapses navigation chrome and never saves real token values in filenames.
CI secrets
| Variable | Purpose |
|---|---|
SPANLINE_TOKEN |
Bearer token for the job |
SPANLINE_WORKSPACE |
Workspace id or slug when the account has multiple workspaces |
Do not print tokens in CI logs. Mask secret variables in your provider.
Sessions
| Practice | Why |
|---|---|
| Revoke unknown sessions | Signs out that browser immediately |
| Sign out on shared machines | Clears the local session cookie |
| Prefer SSO where mandated | Org policy may disable password login |
MFA
When your organization requires MFA:
- Keep recovery codes offline and separate from your laptop.
- Do not disable MFA while you remain in an org that requires it.
What Spanline stores
| Item | Stored as |
|---|---|
| API token secret | Hash only — plaintext shown once at creation |
| Browser session | Server-side session id + HttpOnly cookie |
| Token scopes & workspace pin | Metadata on the token row |