Connect and set up

Tokens: set once, never shown again

Paste a connection's token once; where Yavaren keeps it, or how to use your own vault; Test connection.

Each connection needs a token (an API token, a personal access token, a licence key). You paste it once. It is saved for your organisation only and never shown again, not even to you: the page shows only its name, whether it is set, who set it and when.

Set a token

For the admins of your organisation.

1. Open Connections and choose Tokens next to the connection (or paste the tokens in Add a connection).
2. Each token has a name, for example org-13/azdo-pat. Keep the name shown.
3. Paste the token in Set token and choose Save token. You see Saved — not shown again.
4. Choose Test connection. Each token shows Set or Not set.

To change a token, paste the new one in Replace token. To stop using it, choose Remove; jobs that need it stop until it is set again.

Only admins of your organisation can set, replace or remove tokens.

Where tokens are kept

Managed by Yavaren (the default): in a secret store, under your organisation's own name prefix. Yavaren's runners read a token only for a job of your organisation, and only when the job runs.

Your own vault: your organisation keeps its tokens in its own AWS Secrets Manager, Azure Key Vault, Google Secret Manager or HashiCorp Vault. Choose it in Organisation settings › Secrets, give the vault's address, and give Yavaren read access to your organisation's names only. Then store each token in your vault under the name the Connections page shows. Yavaren keeps only the address and the names. The Secrets page of the documentation has the exact access policies.

On your own installation, tokens you paste are written to the secret store your installation is configured with. If your installation's store cannot be written from the console, each token shows the exact name and a command to create it there yourself (your operator may need to run it). Then choose Check or Test connection: the chip shows Found, Missing or Not checked.

When a token is missing

The job stops before it contacts your tracker or repository, and Recent work says which token and where to set it, for example: Token 'azdo-pat' is not set. Set it in Connections › Northmarq board. Choose Fix in Connections, set it, then choose Requeue.

Good practice

• Give each token the smallest permissions it needs, and one token per connection.
• When you rotate a token, paste the new one with Replace token; the next job uses it.