Fundamentals
Authentication
Sessions, service tokens, and mTLS for Relay Edge.
Relay supports short-lived user sessions, workspace service tokens, and mutual TLS for private origins. Prefer the least-privileged credential for each client.
Credential types
| Type | Lifetime | Use for |
|---|---|---|
| User session | Hours | Dashboard and CLI interactive work |
| Service token | 90 days max | CI deploys and server-to-server APIs |
| mTLS cert | 1 year | Private origin fetches |
Request signing
Attach your service token using the Bearer scheme on the
Authorization header. Rotate tokens from the workspace settings page and revoke compromised credentials immediately.Danger
Service tokens inherit the permissions of the creating member. Create a machine user with a dedicated role for production automation.
- Scope tokens to a single environment when possible.
- Store tokens outside the repository.
- Alert on unexpected geography for token use.