# Upload tokens

Create, rotate, and revoke the credentials used by CI.

## Create and save a token
Owners and admins manage tokens under **Project settings → Upload tokens**. Copy the new token when it is shown and store it in your CI secret manager as `FRAMECHECK_TOKEN`. Keep it out of source files, screenshots, logs, and support messages.

Tokens belong to one project. A token from another project cannot upload on its behalf. There can be at most two active upload tokens per project.

## Rotate without interrupting CI
1. Select **Rotate** and copy the new token. If two tokens are already active, revoke one that is no longer used first.
2. Replace the CI secret in every pipeline that uploads this project.
3. Run the pipeline and confirm the new token works.
4. Revoke the old token.

Rotate keeps the old token active until you revoke it. Revocation stops further use immediately. For a suspected leak, revoke the exposed token promptly even if you must pause CI while replacing it.

## Troubleshoot authentication
Use the project's upload token, not a GitHub personal access token. A token beginning with the wrong prefix or containing internal whitespace is rejected. Save it without quotes or surrounding spaces. Make sure the secret is available to the job, especially for Dependabot and environment-scoped secrets.

If the uploader returns 403, check repository access, project ID, and whether you are using the correct project's token. Do not repeatedly rebuild Storybook to fix an authentication problem; use precheck to verify the configuration first.

## Automatic baseline acceptance
With **Accept main automatically** enabled, someone who can upload for the default branch may cause its images to become the baseline without review. Limit access to the upload token and review your CI's trust boundaries before enabling that setting.