Create the token

The Security Gate step needs a token to download the publication-date database. The variable name in the pipeline is always LEAVORY_TOKEN.

What the token allows

The LEAVORY_TOKEN has a single purpose and no scopes to choose: it is exchanged for a temporary link (15 minutes) to download the signed date database.

The token allows	The token does not allow
Downloading the publication-date database	Reading or changing anything in your Leavory account
	Accessing Azure DevOps, the repository or the registry
	Sending the report or the pipeline code to Leavory

So if a token leaks, the risk is someone using up its daily limit. Even so, treat it as a secret and revoke it if it shows up in a log or a repository.

Rule	Value
Calls per day, per token	30 (each step run makes one). Past the limit, the step skips the check with a warning
Active tokens per account	2, so you can rotate without stopping pipelines

Create the token

1. Go to hub.leavory.com/security-gate.
2. Click New token and give it a name that says where it runs, such as payments-api · main pipeline.
3. Copy the value right away. Once you close the screen it isn’t shown again.

Minimum permissions in Azure DevOps

To store the token you need one of the permissions below. Nothing else is required, and the pipeline needs no extra permission to use the token.

Where to store it	Minimum permission for whoever sets it up	When to use
Pipeline variable	Edit build pipeline on the pipeline	A single pipeline
Variable group (Library)	Creator role in Pipelines → Library to create the group; Administrator on the group to grant pipelines	Several pipelines with the same token

Option 1: pipeline variable

Pipelines → open the pipeline → Edit → Variables → New variable.

Field	Value
Name	LEAVORY_TOKEN
Value	the copied token
Keep this value secret	checked
Let users override this value when running this pipeline	unchecked

Option 2: variable group

1. Pipelines → Library → + Variable group.
2. Add the LEAVORY_TOKEN variable and click the lock to make it secret.
3. Under Pipeline permissions, grant access only to the pipelines that run the Security Gate. Avoid Open access, which opens the group to any pipeline in the project.
4. In the pipeline, reference the group:

variables:
  - group: leavory

Note

Secret variables only reach a script when they are mapped in the step’s env:. The Security Gate template already does this mapping: the variable just needs to exist with the name LEAVORY_TOKEN. Don’t echo or print the token in other steps.

Revoke and rotate

To rotate the token without any pipeline skipping the check:

1. Create the new token (that’s what the second one is for).
2. Update the LEAVORY_TOKEN variable with the new value.
3. Revoke the old token in the Hub.

Pipelines with a revoked token keep running, but skip the check with a token-rejected warning until the variable is updated.