Rotate the CI access token
Replace an expiring Qualflare access token in CI with no failed uploads: create the new token, update the CI secret, run the pipeline, then revoke the old one.
Last updated
To rotate the access token a CI pipeline uses with Qualflare, create a new token, put it in the pipeline's QF_TOKEN secret, run the pipeline once, then revoke the old token; you need the Editor role or higher in the project, on any plan.
Every token expires after 7, 30, 60 or 90 days (30 by default), including the Default token a new project may start with. When a pipeline's token expires, its upload fails with exit code 3.
When to rotate
Rotate a CI token when one of these happens:
- Expires soon appears next to the token in Project Settings > Access Tokens. It shows in the last 7 days before the token expires, except on a 7-day token.
- The token's creator gets the reminder email, 7 days before the token expires (not for 7-day tokens).
- The token may have leaked, or its creator is leaving the project or losing the Editor role: rotate at once. A token never has more access than its creator, and other events end a token early too (Why a token stops working).
Before you begin
- You create the new token in Project Settings > Access Tokens Editor+ · project (requires the Editor role or higher in the project).
- You revoke the old one from the ⋯ menu on its row Maintainer+ · project (requires the Maintainer role or higher in the project); an Editor asks a Maintainer or Owner.
- The project has room for one more token. A project can have 20 tokens that aren't revoked, and expired tokens count until they're revoked.
- You can edit the secret in your CI provider's settings.
Rotate the token
Rotate the token in this order, so that the pipeline always has a token that works.
Create the new token
In Project Settings > Access Tokens, click Create Access Token. Enter a Name that says which pipeline and when, such as GitHub Actions 2026-11, choose an Expiration, leave Allow writes off, and click Create. Copy the value now: it is shown only once.
Create it as someone whose role on the project will stay Editor or higher, because the token never has more access than its creator.
Put it in the CI secret
Replace the value of the secret the pipeline reads, usually QF_TOKEN, with the new token. Each provider page shows where that secret is stored: GitHub Actions, GitLab CI/CD, Jenkins, Azure Pipelines, CircleCI and Bitbucket Pipelines.
With qualflare-action, update the secret that the action's token input reads, whatever its name.
Run the pipeline once
Start a run. qf login <identifier> --force saves the new token over the old one, and qf <identifier> collect uploads with it.
qf login doesn't check the token with Qualflare, so the upload is the test.
Revoke the old token
Revoking takes effect at once: anything still using the old token, such as another pipeline, stops working.
In Access Tokens, open the ⋯ menu on the old token's row, choose Revoke, then confirm with Revoke token. As an Editor, ask a Maintainer or Owner to revoke it.
Verify
After the rotation, you should see:
- In the run's log,
OK Saved identifier "ci". …(with the job's identifier) andOK Test results collected successfully. - The run's launch in Launches.
- The old token gone from Access Tokens: a revoked token leaves the list.
Troubleshoot
These are the errors a CI token rotation can run into:
maximum of 20 access tokens per project allowed; revoke unused tokens before creating new ones: revoke an expired or unused token first. Expired tokens count until they're revoked.invalid or expired access token (status: 401), exit code3, after the rotation: the job still reads the old value, or another secret. Check which secret the job exposes asQF_TOKEN(invalid or expired access token).no project access (status: 403), exit code4: the new token's creator doesn't have the Editor role or higher on the project (the token lacks access).- Revoke is disabled, with
Ask a maintainer or owner to revoke this token.: you are an Editor, so ask a Maintainer or Owner. - Another pipeline fails after you revoke: it used the same token. Give it a token of its own.
Next steps
- Token management: one token per pipeline, with Allow writes off
- Access Tokens: create, use and revoke project tokens
- Authenticate with qf login: how qf saves a token under an identifier
Other CI systems, Docker and npx
Upload test results to Qualflare from Travis CI or any other CI with the qf CLI, its Docker image or npx: self-hosted runners and branch detection included.
Integrations
Send Qualflare events to GitHub, GitLab, Jira, Linear, Slack, Microsoft Teams, Discord and PagerDuty, and set up webhooks for each project.