Developer Access

This page explains how to create a developer token, how tokens are scoped, and how to revoke them.

---

Generating a Developer Token

1. Log in to chainabit.com.
2. Navigate to Settings → Developer.
3. Click Create Developer Token.
4. Enter a name for the token (e.g., "GitHub Actions", "Production Pipeline").
5. Select the scopes your integration needs (see below).
6. Optionally bind the token to a specific account if the integration should not roam across your accessible accounts.
7. Set an expiry in days (1–365).
8. Click Create. Copy the token immediately — it is shown only once and cannot be retrieved later.

The token has the prefix cbt_live_.

---

Available Scopes

Select the minimum set of scopes your integration requires. These are the only scopes a developer token can carry — scopes like contexts:read or agents:execute are Enterprise API Key-only (see Enterprise API Keys) and cannot be granted to a developer token.

Scope	Access granted
execution:run	Create scoped AI runs and automation requests
wallet:read	Read wallet balance and wallet-backed execution readiness
profile:read	Read basic profile fields on routes that explicitly allow developer tokens
email:read	Read email fields on routes that explicitly allow developer tokens
byok:manage	Manage bring-your-own-key credentials when your account is allowed to use BYOK
webhook:manage	Manage webhook subscriptions and inspect delivery metadata

High-risk scopes should be granted deliberately and reviewed regularly.

Using a Developer Token

Pass the token directly as a Bearer token on supported endpoints. No browser login or session exchange is required on current servers.

JavaScript

const response = await fetch(`${BASE_URL}/ai/features/ai.chat.basic/runs`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${DEVELOPER_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    messages: [{ role: 'user', content: 'Run the nightly health check' }],
  }),
});
const { data } = await response.json();

Python

import httpx

result = httpx.post(
    f"{BASE_URL}/ai/features/ai.chat.basic/runs",
    json={"messages": [{"role": "user", "content": "Run the nightly health check"}]},
    headers={
        "Authorization": f"Bearer {DEVELOPER_TOKEN}",
        "Content-Type": "application/json",
    },
).json()

Each request is independently authenticated against the stored token hash. The CLI also supports passing the token through CHAINABIT_TOKEN, --token-env, --token-file, or --token-stdin.

Security Recommendations

• Never embed cbt_live_... tokens in frontend code.
• Never commit tokens to repositories or CI logs.
• Rotate tokens per environment instead of sharing one token across dev, staging, and production.
• Prefer the narrowest scopes possible.
• Revoke tokens immediately if they appear in shell history, screenshots, build logs, or chat transcripts.

Rate Limits

Developer-token requests share the same global rate limit as session-based requests. The default threshold is 120 requests per 60-second window per account.

AI endpoints may also consume credits governed by the entitlements system. See Rate Limiting for full threshold tables.

Revoking a Token

From the Hub: Settings → Developer → find the token → click Revoke. Revocation is immediate; any subsequent request using that token returns 401.

From the CLI:

chainabit auth keys revoke <id>

---

Related

• Authentication — browser login and developer-token basics
• Rate Limiting — request limits and headers
• Quickstart — make your first API call in under 5 minutes