Cloud Foundry runs on trust. That trust is signed and sealed with API tokens. They unlock every interaction with its platform APIs—from pushing code to scaling apps, from managing services to deleting routes. Lose control of tokens, and you lose control of your environment.
API tokens in Cloud Foundry are short-lived. They’re tied to UAA (User Account and Authentication) and issued on login through the cf CLI or API. Each token carries scopes that define exactly what actions you can perform. When the token expires, a refresh token issues a new one, without forcing you back through the login process. This layer isn’t just convenient—it’s how Cloud Foundry enforces secure, fine-grained access control.
Managing API tokens means understanding their lifecycle. A developer running cf login gets an access token and refresh token. The access token is valid for a short window—often just 24 hours—while the refresh token lives longer. The cf CLI uses the refresh token automatically so you can work without interruptions, but in pipelines, things go stale faster. CI/CD systems need new tokens generated securely before scripts run, instead of caching them in insecure locations.
Security around API tokens is not optional. Tokens must be treated like passwords: stored in secure vaults, rotated often, never committed to source control. Logs should redact them. If a token leaks, revoke it through UAA or by resetting your password.