The jm command-line tool can publish releases, install projects and more — on your behalf. To do that it needs an API token: a long secret string that stands in for your password. Treat it exactly like a password.

You may not need to make one

Most people never create a token by hand. Run jm auth login and your browser opens an Authorize button (Google and GitHub sign-in work there); press it and the command line is signed in.

Making one by hand

1. Open the Workspace menu and choose API tokens.
2. Under Create a token, give it a name you will recognise later, such as my-laptop, and press Generate token.
3. Copy it straight away. The token is shown once — after you leave the page, only its first few characters are kept on show.

Using it

• Sign the command line in with it: jm auth login --with-token.
• Or set it for one session: export JM_TOKEN=….
• Your own scripts can send it to the API in the Authorization: Bearer … header — see the API docs.

Keeping track, and switching one off

The Active tokens table lists each token's name, its first characters (Prefix), when it was Created and when it was Last used — or never. A token you do not recognise, or one for a computer you no longer use, should go: press Revoke and confirm. Anything using that token stops working at once; the rest keep going.

More: the jm CLI docs and two-factor sign-in. More guides at https://jmtechpower.com/articles.