---
url: /en/guide/deploy-key.md
description: >-
  Describes CNB deploy keys, which are read-only credentials for securely
  accessing repositories in CI/CD pipelines and scripts without exposing primary
  account credentials.
---
`Deploy Keys` are read-only credentials on the CNB platform.
They allow secure retrieval of repository code or artifacts in CI/CD pipelines
or automated scripts without exposing primary account keys.

## Creating a Deploy Key

Log in and navigate to
`Organization Settings / Repository Settings / Artifact Settings` → `Deploy Keys` → `Add Deploy Key`
to configure the following parameters:

* **Token Name**: Unique identifier for the token
* **Expiration**: Token expiry time; the token becomes unusable after expiration
* **Scope**: Permissions authorized for the token

## Usage

**Accessing Code Repositories:**

* Username: `cnb`
* Password: The added deploy key

**Accessing Artifact Repositories:**

* Username: `cnb`
* Password: The added deploy key

For example, to pull code in a CI job or automated script using a deploy key:

```bash
# Clone the repository (read-only), embedding credentials in the URL for unattended use
git clone https://cnb:${DEPLOY_KEY}@cnbprod.alpha.qq.com/group-path/repo-path
```

> Store `DEPLOY_KEY` in the CI secret/environment variable instead of writing
> the token in plain text into the repository or scripts.

### Accessing OpenAPI

See: [Open API](../develops/openapi.md)

## Deploy Keys vs. Access Tokens

| Aspect          | Deploy Keys                                               | Access Tokens                                                |
| --------------- | --------------------------------------------------------- | ------------------------------------------------------------ |
| Permissions     | Read-only                                                 | Configurable read/write or read-only                         |
| Scope           | Determined by the resource level where the key is created | Tied to user permissions                                     |
| User association | No user association, resource-centric only               | Tied to user, inherits user permissions                      |
| OpenAPI         | Can invoke AI-related endpoints                           | Requires repo write permission \[¹]                           |

> \[¹] The associated user must have repository write permissions.

## Default Permission Rules

* **Private Repositories/Artifacts:** No permissions by default; scopes must be manually selected
* **Public Repositories/Artifacts:** Read-only access by default

## Important Notes

* Deploy Keys are not suitable for write operations (e.g., publishing or uploading artifacts)
* Regularly audit token usage and promptly revoke any that are no longer needed
* Ensure the correct scope is selected during creation to avoid permission errors due to unchecked defaults