Skip to main content
An SDK execution token authenticates your application to Fused at runtime. It is not your CLI key, and it is not a provider credential. Keeping those three straight is most of what there is to know here.

​
Three credentials, three jobs

Never pass the License Key or a provider credential as an execution token, and never put any of them in the SDK config.

​
Generate one

The shared app token commands manage SDK, REST, MCP, and Unified App tokens. The first argument identifies the app by name or stable APP_ID; the second labels the token so you can revoke it later. Use APP_ID when names are ambiguous.
The plaintext prints exactly once. Capture it immediately and store it somewhere real. Omit --expires-in for a non-expiring service credential; use it for temporary access you would rather not have to remember to revoke.
A token belongs to the SDK, not one version. It works with every active or deprecated version, while each version still enforces its own operation scope. --expires-in limits time, not which operations the token may call.
The shared command exposes --allow and --fixed-binding; Fused validates the policy for the selected app. Use repeated --allow flags to restrict a token to exact operation IDs. Each call must satisfy both this allowlist and the selected app version’s operation scope. Omit --allow to use the app’s default token policy.
For OAuth calls, --fixed-binding pins the token to a service, auth scheme, connected-user reference, and optional resource UUID. See fixed bindings for the field format.

​
Flags

​
app token generate

Use --no-input --json in automation. Do not parse the token out of human-readable apply text.

​
The token the first apply gives you

The first successful app apply returns an execution token once, in the response where Fused created it. In JSON output it appears as execution_token on that one response only. An idempotent re-apply will not return it again. If you lose it, generate a new named token rather than re-applying and hoping.

​
After a Fused deployment reset

The Registry is not an SDK configuration archive and cannot restore SDKs after a Fused deployment database reset. Recovery is: reapply your local SDK config, then issue a new execution token. This is a good reason to keep .fused/ in source control.

​
Permissions

Generating, listing, and revoking tokens all require app.tokens.manage. That is deliberately separate from app.manage — a team can own and update an SDK without being able to mint credentials for it, or the reverse.

Run an operation

With a token in hand, call an operation and confirm the whole path works.