For developers
Deploy tokens
One token, one site. It can publish files and read that site's status — and that is the whole list.
Making one
Portal → your site → Deploy tools → create a token. It begins lm_ and is shown once. We store only a hash, so we cannot show it again and neither can anybody who reads our database.
What it reaches
| Can | Cannot |
|---|---|
| Publish to its own site | Touch any other site |
| Read that site's files and history | See your account or billing |
| Restore one of that site's releases | Change a price or a plan |
| Take that site offline, when it names it | Bring it back |
That boundary is why handing one to an assistant is a reasonable thing to do. The worst a leaked token can do is publish to, or take down, the one site it belongs to — and both are undoable.
Revoking
Same page, revoke. It takes effect immediately: the next call with it is refused, including one already in flight from a build that started before you clicked.
Where to keep it
- CI: a repository secret, passed as
LEMONADE_TOKEN. - Your machine:
lemonade loginwrites it to~/.lemonade. See the CLI. - Never in the folder you publish. The CLI skips dotfiles by default, but
--include-hiddenwould publish your token to the public internet.