API Tokens

Personal API tokens authenticate scripts, CI jobs, and the MCP server against the Venelx REST API — without your account password or a browser session.

Tokens always start with the vx_ prefix, so they're easy to recognize (and to scan for in leaked logs).

Creating a token

Open the dashboard → Account → API tokens (app.venelx.com/account/tokens).
Click Create token and choose:
- a name (what it's for — e.g. "laptop MCP", "release CI")
- a scope — read or write (below)
- an optional expiry
Copy the token immediately — the full value is shown once. Venelx stores only a hash, so it can't be recovered later.

Scopes

Scope	What it allows
`read`	Read-only endpoints: list projects, build status, logs, artifacts, workers, signing/GitHub diagnostics
`write`	Everything `read` allows, plus build-trigger endpoints (e.g. `trigger_build`, build-matrix)

A read token calling a write endpoint gets 403 Forbidden — mint a separate write token instead of widening an existing one's blast radius.

Using a token

Send it as a Bearer token in the Authorization header:

bash

curl -s https://api.venelx.com/api/projects \
  -H "Authorization: Bearer vx_..."

The same header is what the MCP server sends under the hood when you set VENELX_TOKEN=vx_....

Expiry and revocation

Tokens with an expiry stop working automatically at that time; tokens without one live until revoked.
Revoke a token any time from Account → API tokens. Revocation is immediate — anything configured with it (MCP configs, cron jobs) starts getting 401 Authentication failed until you mint a replacement and update the config.

Treat tokens like passwords: pass them via environment variables or a secret manager, never commit them, and prefer read scope unless you actually trigger builds. If one leaks, revoke first, investigate second.

← Android Signing MCP Server →