Token types

Production tokens versus development tokens, and when to use each.

Seal supports two token types: Production and Development. They authenticate against the Seal Artifact Server in the same way; they differ in tracking and intended usage.

Production tokens

Activity that uses a production token is tracked by Seal. Production tokens are intended for the CI/CD pipeline of your main branch, where Seal's view of your discovered packages should be authoritative.

Development tokens

Activity that uses a development token is not tracked the same way. Vulnerable packages discovered through scans that authenticated with a development token are filtered out of the Protection page by default, so they do not dilute the production picture with churn from local builds and feature branches.

The Settings > Tokens page itself shows all tokens regardless of type; the default filter applies to scan results on the Protection page, not to the Tokens table.

Picking the right type

Use a production token for any pipeline that runs on your main branch, and a development token for local machines and feature-branch CI/CD.

You do not need a separate token per project or per pipeline. Most tenants operate with a single production token reused across CI/CD pipelines and a single development token shared by developers.

Related

• Generating and revoking tokens: the UI flow.

• Token security best practices: scope, rotation, and storage.