Ability to create scoped API tokens - Githubissues

itchio / butler

🎩 Command-line itch.io helper

MIT License

744 stars 55 forks source link

Ability to create scoped API tokens #225

Open rcorre opened 2 years ago

rcorre commented 2 years ago

I'd like to create butler tokens that can only be used to push builds to a particular project.

Consider this scenario:

I join up with a group of people for a game jam
I create a jam page under my itch.io account
I create a source repo and set up a CI build to automatically push to itch
I add my itch token as a CI secret
I add my teammates as collaborators on the project

My token could be exposed in a few ways:

Someone modifies the build to output the token
I make a mistake in configuring the build and output my own token
I make a mistake configuring permissions to access secrets

It would be nice to know that if a secret leaks, it only grants permissions to a single project, rather than my whole itch.io account.