Automation & CI

Give each pipeline exactly the access it needs

Use API tokens to automate server, network and database tasks in your pipelines. Limit each token to the services and permissions the job needs, and set an expiry date.

See the CI example OpenAPI
GitHub Actions

A database backup before every deploy

Add this step to your deploy workflow. The token in your secrets can only write to this one database service, so even a leaked token can't touch anything else.

.github/workflows/deploy.yml yaml 
- name: Back up the database before deploying
  run: |
    curl -sf -X POST "https://api.faastic.com/v1/orgs/${{ vars.FAASTIC_ORG }}/services/${{ vars.DB_SERVICE }}/data/backups" \
      -H "Authorization: Bearer ${{ secrets.FAASTIC_TOKEN }}"
  # the token only has "read/write" on this one service, nothing else
Token scoping

Least privilege for every pipeline

Tokens start with fst_ and are created in the dashboard.

  • Read, or read & write

    A read token can only look. A read & write token can make changes.

  • Limited to areas

    Servers, networks, firewalls, load balancers, databases, DNS and more. Pick only what the job needs.

  • Limited to projects

    Keep your staging pipeline away from production.

  • Limited to single services

    One database, one server. Everything else stays out of reach.

  • With an expiry date

    Let a token stop working on a date you choose.

  • Never admin rights

    No token can manage team members or other tokens.

  • Confirmed by you

    Creating a token asks for your password or authenticator code, so a hijacked session can't create one.

  • Logged per token

    Changes made through a token show up as you, via that token.

More examples

Firewalls and power, from a script

Open a port when a new service goes live, take a snapshot, reboot after an update. The full list of endpoints is in the OpenAPI document.

OpenAPI document MCP tools
Open HTTPS, then reboot bash 
# Open HTTPS on a server (area: firewalls)
curl -s -X POST "https://api.faastic.com/v1/orgs/$ORG/services/$SERVER/firewall/rules" \
  -H "Authorization: Bearer $FAASTIC_TOKEN" -H "Content-Type: application/json" \
  -d '{"action":"ACCEPT","proto":"tcp","dport":"443","comment":"https"}'

# Reboot it after the deploy (area: servers)
curl -s -X POST "https://api.faastic.com/v1/orgs/$ORG/services/$SERVER/power" \
  -H "Authorization: Bearer $FAASTIC_TOKEN" -H "Content-Type: application/json" \
  -d '{"action":"reboot"}'

Frequently asked questions

Can I use Faastic API tokens in GitHub Actions or another CI/CD tool?

Yes. Create a token for the job, store it in your pipeline's secrets and call the API, for example to back up a database before every deploy.

How narrowly can I limit a token?

Read-only or read & write, limited to areas (servers, firewalls, databases and so on), to projects or to single services, with an expiry date. No token can manage team members or other tokens.

What if a token leaks?

It can only do what its scope allows, it stops working on its expiry date, and you can revoke it in the client area at any moment. Every change it made is in your activity log.

How do I create a token?

In the client area under Team → API tokens. Creating one asks for your password or authenticator code, and the token is shown once.

Create your first token

In the dashboard under Team → API tokens. Copy it once and keep it in your secrets.

Open the dashboard API reference