Automation Tokens
Automation Tokens are bearer credentials for CLI/CI use. They are separate from browser Auth0 sessions.
A token is scoped to exactly one Project or App inside one Workspace. Server authorization always reloads current membership/grants; a token cannot outlive revoked scope authority simply because its bearer string still exists.
Keep the token only in QUOLLVAULT_TOKEN or the CI provider's secret store. Do not put it in command arguments, repository files, logs or support tickets.
Tokens have explicit expiry and can be revoked. Token creation returns the secret once; QuollVault stores only a hash.