Commands

token

Manage org auth tokens

Commands

`sentry token list [<org>]`

List org auth tokens

Arguments:

Argument	Description
`[<org>]`	Organization slug (auto-detected if omitted)

Examples:

# List tokens (auto-detect org)
sentry token list

# List tokens in a specific org
sentry token list my-org

# Output as JSON
sentry token list --json

`sentry token create <org/name>`

Create an org auth token

Arguments:

Argument	Description
`<org/name>`	[<org>/]<name> - Name of the new token

Options:

Option	Description
`-n, --dry-run`	Show what would happen without making changes

Examples:

# Create a token (auto-detect org)
sentry token create github-actions

# Create a token in a specific org
sentry token create my-org/github-actions

# Output as JSON, including the token value
sentry token create my-org/github-actions --json

`sentry token delete [<org>/]<token-id-or-name>`

Revoke an org auth token

Arguments:

Argument	Description
`[<org>/]<token-id-or-name>`	[<org>/]<token-id-or-name> - ID or name from sentry token list (not the token value)

Options:

Option	Description
`-y, --yes`	Skip confirmation prompt
`-f, --force`	Force the operation without confirmation
`-n, --dry-run`	Show what would happen without making changes

Examples:

# Revoke token ID 12345 (auto-detect org)
sentry token delete 12345

# Revoke the token named github-actions
sentry token delete my-org/github-actions

# Preview revoking token ID 12345
sentry token delete my-org/12345 --dry-run

# Revoke without the confirmation prompt
sentry token delete my-org/12345 --yes

All commands support --json for machine-readable output and --fields to select specific JSON fields.

Permissions

Sentry only lets a CLI login from sentry auth login manage org auth tokens. Personal tokens, org auth tokens, and SENTRY_AUTH_TOKEN can't create, list, or revoke them.

The login also needs the org:tokens scope, which isn't part of the CLI's default login. The first sentry token command asks you to re-authorize and adds it. Creating a token also needs org:ci, because a login can only give a new token scopes it holds itself, and revoking one needs org:write (org owners and managers).

Re-authorization only happens in interactive runs: with --yes, --json, or --dry-run the CLI never starts the authorization flow, so run a sentry token command once without those flags first.

New tokens always get the org:ci scope. Sentry returns a token's value only when it's created, so save it right away.

Self-hosted Sentry needs a version that supports the org:tokens scope. Older servers reject the authorization request with an unknown-scope error.