Tokens

How Publier sign-in tokens work — where Publier looks, precedence, renewal, and the error codes you may see.

Both publier dev and publier build require a seat: an account that an administrator has granted access to Publier. The seat is carried by an OAuth access token, which publier login obtains and stores for you. Missing, expired, or unentitled credentials cause an immediate exit 1 — there is no dev-only fallback.

Where Publier looks

Publier resolves a credential in this order:

PUBLIER_TOKEN environment variable — takes precedence over all other sources.
~/.config/publier/auth.json — written by publier login, mode 0600.

$XDG_CONFIG_HOME is honoured when it is an absolute path, so the store follows a relocated config directory.

PUBLIER_TOKEN carries a bare access token with no refresh half: it never renews itself, which is exactly right for a short-lived CI credential. Set it in your CI environment so you don’t need a token file in the repository.

How the seat is checked

Human OAuth access tokens are verified locally against the keys cached at ~/.config/publier/jwks.json by sign-in. A valid token and cached configuration can support an offline build; token renewal and refreshing the cache need a connection. Pasting a token onto a fresh machine does not create the cache.

CI workload credentials use a different path: they are short-lived, proof-bound credentials verified online. The public CI action provisions the credential and configuration; pass both its token and proof-key outputs to the build as PUBLIER_TOKEN and ATESTUM_PROOF_KEY. The proof-key output is a path to the PEM private-key file used by the verifier. Do not copy a person’s token cache into CI. See the deployment workflow.

Revocation is online rather than offline: your access token is short-lived and the CLI renews it in the background. If your seat is withdrawn, the renewal is refused and builds stop once the current token expires. There is no offline revocation list to keep fresh and no staleness deadline to beat.

A seat is not bound to a hostname. Nothing about the build output is tied to the domain you deploy to.

Getting a seat

Email hello@publier.dev with your intended use, or sign up via the website. Once your account has a seat, run publier login.

If you already have a Publier subscription and someone else administers it, ask them to assign you a seat — you don’t need a new account.

Error codes

Every failure prints its code first, so both humans and scripts can act on it. The recovery steps below describe human access tokens:

Code	Meaning	What to do
`MISSING`	No credential at all.	Run `publier login`.
`MALFORMED`	The stored credential isn’t a usable token.	Run `publier logout`, then `publier login`.
`SIGNATURE_INVALID`	The token wasn’t signed by the Publier sign-in service, or was minted for a different application.	Run `publier login`.
`EXPIRED`	The credential expired and could not be renewed.	Run `publier login`.
`NOT_YET_VALID`	The credential isn’t valid yet.	Check this machine’s clock.
`NO_SEAT`	You are signed in, but this account holds no Publier seat.	Ask an administrator to assign you a seat. Signing in again will not help.
`UNVERIFIABLE`	Human-token verification lacks cached signing keys or client configuration.	Run browser or device `publier login` once while online.

For CI workload credentials, UNVERIFIABLE can instead mean the online verifier is unreachable or returned an availability/proof error. Read the accompanying diagnostic and check verifier connectivity and the job’s credential, configuration, and proof-key setup. Interactive publier login does not repair that CI path; use the per-job claim workflow. Other CI failures likewise need workload-specific recovery rather than the human-token commands in this table.

Rotation

Signed-in machines rotate on their own — there is nothing to do. To force a fresh credential:

Local: run publier login again.
CI: claim a fresh workload credential for each job with the public CI action. No stored PUBLIER_TOKEN secret is needed for this path.

The next invocation picks up the new credential immediately. Run publier logout to remove this machine’s stored sign-in and caches. Server revocation is best-effort and requires cached issuer discovery and an available revocation endpoint; successful local sign-out does not prove revocation. Have an administrator remove the seat to withdraw build access.