per-run token
A short-lived, single-run authentication token used to securely prove run identity within an isolated environment, typically based on an HMAC signature.
Timeline (last 90 days)
The control plane mints a per-run token, an HMAC signature based on the run id and expiration time, valid for 30 minutes and restricted to a single run.
Workflow inputs appear on the run page, and anyone who can view the repository's Actions run records can see the token until it expires, so the token is designed to be short-lived and narrowly scoped.
All Facts (2)
The control plane mints a per-run token, an HMAC signature based on the run id and expiration time, valid for 30 minutes and restricted to a single run.
50%UnverifiedWorkflow inputs appear on the run page, and anyone who can view the repository's Actions run records can see the token until it expires, so the token is designed to be short-lived and narrowly scoped.
50%