logo

nsc bazel create-token

Create a revocable token for Bazel remote execution.

nsc bazel create-token generates a revocable token that's pre-scoped to the permissions needed for Bazel Remote Execution, so CI/CD pipelines and other non-interactive environments can authenticate without going through the interactive login flow. It's a narrower, purpose-built counterpart to nsc token create — instead of specifying a --grant yourself, the token is automatically scoped to what Remote Execution needs.

The generated token is written to a JSON file that can be passed to nsc bazel setup to provision short-lived credentials for the execution cluster. Like other revocable tokens, it can be revoked at any time from cloud.namespace.so/user/sessions or with nsc token revoke.

Usage

nsc bazel create-token [--expires_in <duration>] [--scope <tenant|user>] [--token <path>]

Example

Create a token with a 10-day expiration and write it to rbe-token.json:

$ nsc bazel create-token \
  --token rbe-token.json \
  --expires_in 10d

Then pass the token file to nsc bazel setup to configure a bazelrc that authenticates with it:

$ nsc bazel setup --token rbe-token.json --bazelrc=namespace.bazelrc

Options

--expires_in

Duration until the token expires. Defaults to 2160h (90 days). Available time units are: h (hours), d (days), w (weeks), and y (years).

--scope

Set the scope of the generated access token. Valid options: tenant, user. Defaults to user. Tokens with user scope are bound to the tenant membership of the current user; tenant scope isn't tied to a specific user's workspace membership.

--token

Write the token to this file in JSON format. Defaults to token.json. Pass this file to nsc bazel setup --token <path> to authenticate with it.