Skip to main content
CodeAnt API tokens authenticate you to CodeAnt. Use one anywhere a CI pipeline or a script needs to talk to CodeAnt - coverage upload, automated scans, quality gates, or the REST API. A single CodeAnt token replaces the per-platform VCS access tokens (GitHub PAT, GitLab token, Bitbucket access token, Azure DevOps PAT) you previously pasted into pipelines. You create it once in CodeAnt and reuse it everywhere.
A CodeAnt token authenticates to CodeAnt, not to your Git provider. It always starts with the prefix cdt_ and is scoped to a single provider + organization.

​
Create a token

  1. Open CodeAnt AI, then open the user menu (click your email at the bottom-left of the sidebar) and select API Tokens.
  2. Click Create token.
  3. Check the Bound to chip - it shows the provider and organization the token will belong to. Tokens are scoped to the workspace you’re currently in, so switch workspaces first if you need a token for a different organization.
  4. Give the token a descriptive name (for example ci-coverage or automation-token). Names can be up to 60 characters.
  5. Choose the token’s Scope (optional, but recommended - see Permissions and scopes):
    • Role - pick a role that grants only the permissions the token needs: Codeant CI/CD for pipeline tokens (scans, quality gates, coverage), Codeant Member for read-only reporting, Codeant Admin for full access, or any custom role defined in Access Control. Leave it on Full access (no restriction) for an unscoped token.
    • Repositories - once a role is chosen, restrict the token to specific repositories, or tick All repositories to cover the whole organization (including repos added later).
    A token can never grant more than you can access yourself.
  6. Click Create token.
  7. Copy the token immediately. It starts with cdt_ and is shown only once - for security, the full value is never displayed again. Store it in your secret manager or CI secret store. CodeAnt only keeps the last 4 characters for identification.
If you lose a token, you can’t recover it - create a new one and revoke the old one.

​
Use a token

CI pipelines Add the token to your pipeline as a secret, then pass it as the access-token input of the CodeAnt coverage, scan, or quality-gate step. See: REST API Send the token as a bearer token in the Authorization header:

​
Permissions and scopes

A token can be limited by a role (which product areas / actions it may use) and a repository scope (which repos it may touch). Any request outside the token’s scope is refused with HTTP 403 and a body like:
The message distinguishes a missing permission from a token that simply isn’t scoped to that repository.

​
Roles

Roles are defined in Access Control (Settings → Access Control). Three presets ship by default; admins can also create custom roles. For a CI/CD pipeline token, Codeant CI/CD is the recommended role.

​
Repository scope

  • All repositories - the token works across the whole organization, including repositories added later.
  • Specific repositories - the token only works on the repositories you select. Any other repository returns 403 with “This token isn’t scoped to <repo>”.

​
Permission required per API area

A permission reflects the product area of the data, so the same permission gates the dashboard and the API. cicd is reserved for pipeline plumbing that has no dashboard equivalent.
The Codeant CI/CD role covers the entire CI surface above (scans, quality gates, coverage) plus read access to the security/quality areas a pipeline gates on - so a single CI token needs only this one role.

​
Creator cap & existing tokens

  • A token can never exceed the access of the person who creates it. If you request more than you have, creation is rejected with a 403 explaining which permission exceeded your access.
  • Backwards compatible: tokens created before scoping existed - and raw VCS provider tokens (GitHub / GitLab / Bitbucket / Azure DevOps PATs) used directly against the API - keep full access. Scoping only applies to new tokens you explicitly scope.

​
Manage and revoke tokens

The API Tokens page (open the user menu - your email at the bottom-left of the sidebar - and select API Tokens) lists every token for the current workspace, each showing a masked value (cdt_••••last4), the provider and organization it’s bound to, when it was created, and whether it’s Active or Revoked. To revoke a token, hover over it and click the trash icon, then confirm Delete token. Revocation is immediate and irreversible - any client still using that token loses access right away.
To rotate a token without downtime, create the new token first, update your CI secrets to use it, and only then revoke the old one.