pscale service-token
Create, list, and manage service tokens for CI/CD and automation.
Common Commands
# Create service token
pscale service-token create --org <org>
# List service tokens
pscale service-token list --org <org>
# Show safe metadata for one service token
pscale service-token show <token-id> --org <org> --format json
# Delete service token
pscale service-token delete <token-id> --org <org>
Workflows
CI/CD Setup (GitHub Actions)
# 1. Create service token
pscale service-token create --org my-org
# Returns:
# TOKEN_ID: xxxxx
# TOKEN: yyyyy
# 2. Add to GitHub Secrets
# PLANETSCALE_SERVICE_TOKEN_ID = xxxxx
# PLANETSCALE_SERVICE_TOKEN = yyyyy
# 3. Use in workflow
# .github/workflows/deploy.yml
# env:
# PLANETSCALE_SERVICE_TOKEN_ID: ${{ secrets.PLANETSCALE_SERVICE_TOKEN_ID }}
# PLANETSCALE_SERVICE_TOKEN: ${{ secrets.PLANETSCALE_SERVICE_TOKEN }}
# run: |
# pscale deploy-request deploy my-db my-branch
CI/CD Pipeline Integration
# 1. Create service token
pscale service-token create --org my-org
# 2. Add to your CI/CD secrets/variables
# PLANETSCALE_SERVICE_TOKEN_ID
# PLANETSCALE_SERVICE_TOKEN
# 3. Use in your pipeline config (.github/workflows, .gitlab-ci.yml, etc.)
# deploy:
# script:
# - pscale deploy-request create $DATABASE $BRANCH_NAME
Token Rotation
# 1. List existing tokens
pscale service-token list --org my-org
# 2. Create new token
pscale service-token create --org my-org
# 3. Update CI/CD secrets
# 4. Delete old token
pscale service-token delete <old-token-id> --org my-org
Inspect a service token
pscale service-token show returns safe service-token metadata such as ID, name, creation time, and last-used time. It does not print the token secret and does not include access grants; use show-access when grants are needed.
pscale service-token show <token-id> --org <org> --format json
pscale service-token show-access <token-id> --org <org> --format json
Treat token IDs and grant details as sensitive operational metadata. Never ask the user to paste a service token secret into chat; use environment variables or a secrets manager.
Troubleshooting
Token authentication fails
Error: 401 Unauthorized
Solutions:
- Verify both TOKEN_ID and TOKEN are set correctly
- Check token hasn't been deleted:
pscale service-token list - Ensure token has required permissions
- Try creating new token (old may be expired)
Token not showing in list
Cause: Tokens are organization-scoped
Solution:
# Ensure correct org
pscale org show
# List tokens for specific org
pscale service-token list --org <correct-org>
Security Best Practices
- Rotate tokens regularly (every 90 days recommended)
- Use separate tokens for different CI/CD systems
- Delete unused tokens immediately
- Never commit tokens to version control
- Use secrets management (GitHub Secrets, environment variables, vault systems)
- Limit token scope if possible (coming in future PlanetScale updates)
Related Skills
- pscale-auth - Interactive authentication (development)
- pscale-deploy-request - Automated deployments via tokens
- gitlab-cli-skills - GitLab CI integration
- github - GitHub Actions integration
References
See references/commands.md for complete command reference.