> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# nsc bazel create-token

Create a revocable token for Bazel remote execution.

`nsc bazel create-token` generates a revocable token that's pre-scoped to the
permissions needed for [Bazel Remote Execution](/docs/bazel/execution), so
CI/CD pipelines and other non-interactive environments can authenticate
without going through the interactive login flow. It's a narrower,
purpose-built counterpart to [`nsc token create`](/docs/reference/cli/token-create) — instead
of specifying a `--grant` yourself, the token is automatically scoped to what
Remote Execution needs.

The generated token is written to a JSON file that can be passed to
[`nsc bazel setup`](/docs/reference/cli/bazel-setup) to provision short-lived
credentials for the execution cluster. See
[Remote Execution from CI](/docs/bazel/execution#remote-execution-from-ci) for the
full flow. Like other revocable tokens, it can be revoked at any time
from [cloud.namespace.so/user/sessions](https://cloud.namespace.so/user/sessions)
or with [`nsc token revoke`](/docs/reference/cli/token-revoke).

## Usage

```bash theme={null}
nsc bazel create-token [--expires_in <duration>] [--scope <tenant|user>] [--token <path>]
```

### Example

<Steps titleSize="h4">
  <Step title="Create a token">
    Create a token with a 10-day expiration and write it to `rbe-token.json`:

    ```bash theme={null}
    nsc bazel create-token \
      --token rbe-token.json \
      --expires_in 10d
    ```
  </Step>

  <Step title="Configure Bazel">
    Pass the token file to `nsc bazel setup` to configure a bazelrc that
    authenticates with it:

    ```bash theme={null}
    nsc bazel setup --token rbe-token.json --bazelrc=namespace.bazelrc
    ```
  </Step>
</Steps>

## Options

<h3 id="--expires_in">
  \--expires\_in
</h3>

Duration until the token expires. Defaults to `2160h` (90 days). Available
time units are: `h` (hours), `d` (days), `w` (weeks), and `y` (years).

<h3 id="--scope">
  \--scope
</h3>

Set the scope of the generated access token. Valid options: `tenant`, `user`.
Defaults to `user`. Tokens with `user` scope are bound to the tenant
membership of the current user; `tenant` scope isn't tied to a specific
user's workspace membership.

<h3 id="--token">
  \--token
</h3>

Write the token to this file in JSON format. Defaults to `token.json`. Pass
this file to `nsc bazel setup --token <path>` to authenticate with it.

## Related Topics

* [nsc token create](/docs/reference/cli/token-create) - Create a general-purpose revocable token with custom grants
* [nsc token revoke](/docs/reference/cli/token-revoke) - Revoke a token
* [Bazel Remote Execution](/docs/bazel/execution) - Run Bazel actions on Namespace compute