Getting started
Authentication and API tokens
How to authenticate to AEON Cloud: interactive login, scoped personal access tokens, machine tokens for CI, SSO, and token rotation.
5 min read
Every call — CLI, REST, SDK — is authenticated with a bearer token. Interactive users get short-lived tokens via browser login; automation gets long-lived scoped tokens you manage in the portal.
Interactive login
bashbash
aeon login aeon login --sso acme-corp # SAML / OIDC workspaces
Machine tokens
Create a machine token in the portal under API tokens. Scope it to the minimum set of capabilities the pipeline needs.
| Scope | Grants |
|---|---|
| builds:write | Push and tag UE builds |
| exec:run | Start executions and reserve lanes |
| exec:read | Stream logs and read verdicts |
| reports:read | Download PDF/JSON reports |
| admin:* | Team, billing, and workspace settings |
Using a token
bashbash
export AEON_TOKEN=aeon_pat_xxxxxxxxxxxxxxxx aeon exec list curl -H "Authorization: Bearer $AEON_TOKEN" https://api.aeon.cloud/v1/executions
noteTokens are shown once. Rotate with `aeon tokens rotate --id tok_...`; the old token stays valid for a 60-minute overlap window.
Run this against a real SDR lane
The tester is a service, not a box. Push a build, reserve a lane, get a verdict.