Publish

Give CI only the access it needs.

Publish keys are app-scoped credentials with the publish scope. Their full value is displayed once and stored by Releases only as a hash.

App scopedRevocableOne-time display

Create and store a key

Open Publish key

Choose the app, then its Publish key tab.

Create key

The dashboard displays the full token once.

Copy it now

If the value is lost, generate a replacement; the existing token cannot be revealed.

Add the GitHub secret

Store it as MATEALITY_RELEASES_KEY under Settings → Secrets and variables → Actions.

Use it as a bearer token:

http
Authorization: Bearer mtr_...

The publishing API also accepts the token in x-api-key, but the GitHub Action uses bearer authorization.

App boundary

A key can publish only to the app whose slug matches the publishing URL. Using the same token with another app returns key_app_mismatch.

Rotation

Create a replacement, update the CI secret, run the workflow successfully, and then revoke the old key. Revocation is immediate for subsequent publishing API requests. The key list shows whether a token was never used, its last-used timestamp, or its revoked state.

Authentication failures

  • missing_token: no supported authentication header was present.
  • malformed_token: the key prefix could not be parsed.
  • unknown_key or invalid_signature: the token is not valid.
  • revoked: the key has been revoked.
  • insufficient_scope: the stored key is not a publish key.
  • key_app_mismatch: the URL identifies a different app.