Personal Access Tokens, Headless CI/CD, and the 30-Day Hard Limit

As we continue to expand the Ennote CLI's capabilities, a critical requirement for our enterprise users has been the ability to automate secret injection in headless environments. Today, we are bridging the gap between our interactive SSO flows and machine-driven automation by introducing Personal Access Tokens (PATs).

Personal Access Tokens allow you to securely authenticate with the Ennote CLI directly without needing an interactive browser session.

Here is an architectural breakdown of how PATs integrate into your DevSecOps pipelines, and why we made specific "Security by Design" decisions regarding their lifecycle.

Seamless CI/CD Integration

In local development, the Ennote CLI uses an OAuth 2.0 PKCE flow to bind an ephemeral session to the developer's OS Keyring. However, CI/CD runners (like GitHub Actions, GitLab CI, or Jenkins) are headless and ephemeral by nature. They cannot execute interactive browser logins.

With the introduction of PATs, you can now provision a cryptographic token directly from your User Settings -> Security dashboard.

Once generated, injecting secrets into a CI/CD pipeline is as simple as exposing the token via the ENNOTE_TOKEN environment variable.

# Example: Secure headless execution in GitHub Actions
steps:
  - name: Run Production Migrations
    env:
      ENNOTE_TOKEN: ${{ secrets.ENNOTE_USER_TOKEN }}
      ENNOTE_ORGANIZATION_ID: org_production
      ENNOTE_WORKSPACE_ID: wrk_database
    run: |
      ennote secret get "db-credentials" -- npm run migrate

This entirely bypasses the interactive login handshake, allowing the CLI to fetch and inject secrets directly into the memory space of your deployment scripts.

Security by Design: The 30-Day Hard Limit

Long-lived credentials are one of the most pervasive vulnerabilities in modern infrastructure. A token that never expires is a ticking time bomb. If a PAT is accidentally leaked in a build log or committed to version control, an attacker has perpetual access.

To enforce security best practices, tokens must have a definitive lifespan. When creating a token, you can select an expiration period of 1 hour, 8 hours, 1 day, 7 days, 14 days, or a maximum of 30 days.

Why cap it at 30 days?

1. Minimizing Blast Radius: By enforcing a strict 30-day maximum, we ensure that the utility of a leaked token degrades rapidly.

2. Forcing Credential Hygiene: Indefinite tokens encourage "set it and forget it" anti-patterns. A 30-day limit forces infrastructure teams to build automated rotation into their CI/CD lifecycle, ensuring that credentials are treated as ephemeral artifacts rather than static infrastructure.

3. Compliance by Default: SOC 2 and ISO 27001 compliance frameworks mandate strict credential rotation policies. Ennote enforces this out of the box, ensuring your pipelines remain compliant without manual oversight.

Token Management and Revocation

We have built the PAT management UI with strict visibility and control boundaries:

• Token Limits: Users can generate and manage up to 10 active Personal Access Tokens at any given time. This prevents token sprawl and ensures developers are actively managing their machine identities.

• Write-Once Visibility: For cryptographic safety, the token value is only displayed once upon creation. We do not store the plaintext token in our database; we only store a salted, one-way hash.

• Instant Revocation: Tokens can be revoked immediately from the dashboard at any time if they are no longer needed or if you suspect a compromise. Revocation instantly terminates all downstream API and CLI access utilizing that token

Stay Tuned: Tokenless OIDC Integration

While PATs provide a highly secure, time-bound bridge for standard CI/CD workflows, the ultimate goal in enterprise secret management is eliminating long-lived credentials entirely.

In our upcoming releases, we plan to implement tokenless OIDC (OpenID Connect) integration with major CI/CD platforms (such as GitHub Actions and GitLab CI). This architectural upgrade will allow your runners to authenticate directly with Ennote using short-lived identity federation.

The result? Zero hardcoded tokens, zero rotation overhead, and an airtight, fully ephemeral security posture.