tokens:setup

Introduction
The forge token
1. Another Forgejo or Gitea
2. github.com
The PyPI token
Reloading after an edit
Credentials it does not cover
See also

Introduction

tokens:setup prints how to get the forge and PyPI tokens you need to release and to run the checks. The steps follow the forge your workspace uses. It takes no options.

splent tokens:setup

  SPLENT_FORGE_TOKEN
  Used by: feature:release, feature:versions, feature:upgrade,
           feature:search, check:forge

  How to get it:
    1. Go to git.splent.io → Settings → Applications
       → Access Tokens
    2. Generate new token
    3. Enable scopes: write:repository, write:organization and write:package (product images go to the forge registry)
    4. Copy the token (shown only once)

  Add to your .env:
    SPLENT_FORGE_USER=<your git.splent.io username>
    SPLENT_FORGE_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

  TWINE_USERNAME + TWINE_PASSWORD
  Used by: feature:release, check:pypi

  How to get it:
    1. Go to pypi.org → Account settings → API tokens
    2. Add API token
    3. Scope: 'Entire account' or limit to a specific project
    4. Copy the token (shown only once)

  Add to your .env:
    TWINE_USERNAME=__token__
    TWINE_PASSWORD=pypi-xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Put them in the workspace .env, then run splent check:forge and splent check:pypi.

The forge token

Every release and every clone of a private repository use it. Set SPLENT_FORGE_USER too, since check:forge compares it with the token’s owner. git gets the token as a header, never in a URL, which needs git 2.31 or later.

Another Forgejo or Gitea

SPLENT_FORGE_HOST=git.example.org
SPLENT_FORGE_SSH_PORT=2222
SPLENT_FORGE_USER=your-username
SPLENT_FORGE_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Variable	Default
`SPLENT_FORGE_HOST`	`git.splent.io`
`SPLENT_FORGE_SSH_HOST`	`SPLENT_FORGE_HOST`
`SPLENT_FORGE_SSH_PORT`	`2223` on git.splent.io, else `22`
`SPLENT_FORGE_API`	`https://<host>/api/v1`
`SPLENT_FORGE_KIND`	`github` for github.com, else `forgejo`
`SPLENT_CLONE_TRANSPORT`	SSH then HTTPS. Set `https` on a machine with no SSH key

github.com

SPLENT_FORGE_HOST=github.com
GITHUB_USER=your-username
GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create a classic token with the repo scope. On any forge the CLI reads SPLENT_FORGE_TOKEN and SPLENT_FORGE_USER first, then GITHUB_TOKEN and GITHUB_USER.

The PyPI token

TWINE_USERNAME is always __token__, and PYPI_USERNAME and PYPI_PASSWORD work too. A project-scoped token uploads only that project, so creating a new project needs an account-wide token and counts against PyPI’s new-project limits.

Reloading after an edit

The CLI reads .env on every run, but a variable your shell exports wins. make cli exports .env when you enter the container, so after you change a value there, by hand or with env:set, run source .env or open a new make cli. On the host, saving the file is enough.

env:show reports a stale export as loaded but differs.

Credentials it does not cover

Credential	Where it comes from
The marketplace token	`splent login`, never `.env`. Only `spl:publish` needs it
A UVLHub API key	None. The marketplace holds one for everybody, so you never generate your own
`DOCKERHUB_USERNAME`, `DOCKERHUB_PASSWORD`	`.env`, when a product lists `dockerhub` among its registries