#Migrate deployment auth to CI tokens

Server tokens and personal tokens still work for deployments. Using them for deployments is planned for deprecation, and no removal date has been announced.

We recommend moving your pipelines to CI tokens now. CI tokens are organization-scoped credentials for build pipelines, and they use the ZE_CI_TOKEN environment variable.

Use this guide if a pipeline authenticates Zephyr with ZE_SERVER_TOKEN and ZE_USER_EMAIL, or with ZE_SECRET_TOKEN.

#What to replace

#Before you start

• You need access to the organization settings in Zephyr Cloud.
• Keep the existing deployment secret available until one CI-token build succeeds.
• Update one repository or pipeline first, then repeat for the rest.

#Create a CI token

1. Open Zephyr Cloud.
2. Go to Organization Settings.
3. Open CI tokens.
4. Generate a CI token.
5. Copy the token value. It is only shown when the token is created.

#Update GitHub Actions

Add the CI token as a repository or organization secret, then expose it as ZE_CI_TOKEN in the job that runs the Zephyr build.

env:
  ZE_CI_TOKEN: ${{ secrets.ZEPHYR_CI_TOKEN }}

After the build succeeds, remove the old variables from that job:

# Remove these after ZE_CI_TOKEN is working.
ZE_SERVER_TOKEN: ${{ secrets.ZEPHYR_SERVER_TOKEN }}
ZE_USER_EMAIL: user@example.com
ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_PERSONAL_TOKEN }}

#Update GitLab CI/CD

Add the CI token as a masked CI/CD variable, then expose it as ZE_CI_TOKEN.

build:
  stage: build
  script:
    - pnpm install --frozen-lockfile
    - pnpm build
  variables:
    ZE_CI_TOKEN: $ZE_CI_TOKEN

After the CI-token pipeline succeeds, remove ZE_SERVER_TOKEN, ZE_USER_EMAIL, and ZE_SECRET_TOKEN.

#Verify the migration

Run the pipeline and confirm the Zephyr build authenticates without ZE_SERVER_TOKEN or ZE_SECRET_TOKEN.

If the build fails:

• Confirm the secret name in the CI provider matches ZE_CI_TOKEN.
• Confirm the CI token still exists in Zephyr Cloud.
• Generate a new CI token if the original token value was lost.

#Clean up old tokens

Once every pipeline for the repository uses ZE_CI_TOKEN, you can revoke the server token under Organization Settings > Server Tokens.

If a personal token was used only for deployments, you can revoke it from your profile settings. If it is used for other workflows, keep it and remove it only from deployment jobs.

#Related docs

• CI Tokens
• Server token deployments
• Personal token deployments