# noust token

Manage API tokens: named, scoped credentials for scripts and automation.

```bash
noust token [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`create`](#noust-token-create), [`list`](#noust-token-list), [`revoke`](#noust-token-revoke), [`set`](#noust-token-set)

## noust token create

Issue a named, scoped API token. NAME must be unique across every token ever issued, live or revoked.

```bash
noust token create [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--scope` | What the token may do. | `read` |
| `--expires-hours` | Lifetime in hours. Omitted: the token only dies by revocation. |  |
| `--owner` | Account the token acts for, with at most its role. Required under the ENS profile. |  |
| `--permission` | Narrow the token to this permission (repeat). The owner must hold it. |  |
| `--team` | Bind the token to this team: it sees nothing else (needs --owner). |  |
| `--project` | Bind it to this project of the team. |  |
| `--env` | Bind it to this environment. |  |
| `--allow-ip` | Accept the token only from this address or network (repeat). Omitted: from anywhere. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust token list

List every API token ever issued, live and revoked alike.

```bash
noust token list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the tokens as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust token revoke

Revoke one API token by its id, as listed by 'noust token list'.

```bash
noust token revoke [OPTIONS] TOKEN_ID
```

Arguments: `token_id`

| Option | What it does | Default |
|---|---|---|
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust token set

Change the networks a live API token is accepted from, without issuing another.

```bash
noust token set [OPTIONS] TOKEN_ID
```

Arguments: `token_id`

| Option | What it does | Default |
|---|---|---|
| `--allow-ip` | Accept the token only from this address or network (repeat); replaces the list. |  |
| `--any-ip` | Accept the token from anywhere again. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |