Who revoked that token? Reading the dotvault audit log
This is part 10 of the series "dotvault, Start to Finish: One Command from Your Laptop to CI, Your Team, and Your AI Agents." dotvault will be released free of charge when this series ends. The demo org had two service tokens called ci-deploy . When a CI pull started failing with AUTH_REQUIRED , the name could not say which of the two had been revoked. The dotvault audit log could: it named the…
When a CI pull fails with AUTH_REQUIRED, it can be difficult to determine which of the two service tokens, called ci-deploy, has been revoked. The dotvault audit log provides detailed information about service tokens being created, revoked, and related projects being archived and deleted. Each row in the audit log contains an actor, a target, and metadata.
By filtering the audit log for the action service_token.revoked, the revocation events can be isolated, showing the actor's email, the time of the revocation, and the token's name. The token's unique Token ID, which can be found in the Target column, helps distinguish between tokens with the same name. The audit log also reveals the environment the token was created for and its expiry.
Two service tokens, ci-deploy, were created: one was revoked by the user dev-a in the console, while the other was created for this part of the series. The Token ID, which can be found in the console, is the distinguishing factor between the two tokens. The audit log also displays when the token was last used, and the number of secrets the project held before it was deleted.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
