[sentry-junior]

Adds sentry token list, sentry token create, and sentry token delete for org auth tokens (the org:ci tokens used for source map, debug file, and release uploads). sentry tokens is an alias for token list. This is the CLI side of getsentry/sentry#128051, and replaces the archived getsentry/cli#1112.

sentry token list [<org>]
sentry token create [<org>/]<name>        # prints the token value once
sentry token delete [<org>/]<token-id>    # buildDeleteCommand: --yes/--force/--dry-run, type-to-confirm

Scopes

Sentry only lets OAuth application tokens that hold org:tokens manage org auth tokens. Personal tokens, org tokens, and SENTRY_AUTH_TOKEN get a 403. Here's what each endpoint requires, checked against the merged backend:

Command	Needs
list	org:tokens + org:read
create	org:tokens + org:read + org:ci (an OAuth caller can only mint scopes it holds)
delete	org:tokens + org:read + org:write (the delete is org:write, the confirm lookup is org:read)

org:tokens is now in SENTRY_SCOPES, so auth login --scope org:tokens validates. I kept it out of the default OAUTH_SCOPES on purpose. The device flow rejects the whole request when it sees a scope it doesn't know, so adding org:tokens to the defaults would break sentry auth login on older self-hosted servers.

Instead, each token command calls ensureScopesForAction, and it can now ask for scopes outside the defaults:

• If required only names default scopes, nothing changes: the device flow requests the defaults.
• Otherwise it requests three things: the defaults, the known opt-in scopes the grant already has (so elevating for one command doesn't remove what an earlier elevation added), and required.

When elevation is needed but this run can't do it (no TTY, --yes, or --json), a 403 gets a specific explanation: what to run once interactively, or that the command needs a CLI login plus an org role that allows it.

Notes for review

• The endpoints are control-silo, so they're called through getControlSiloUrl(). They aren't in @sentry/api (checked 0.399.0), so OrgAuthTokenSchema is a Valibot schema that mirrors the backend serializer.
• The full token value only appears in create output, including --json, because Sentry can't return it again. list shows only tokenLastCharacters.
• delete reads the list to show the token name in the confirmation, since there's no single-token GET. The list is unpaginated server-side.
• create splits org/name on the first /, but only when the prefix looks like an org slug. Names containing / work as long as the org is given explicitly.

Tests

• New tests for the API module, the shared helpers, all three commands, and the opt-in scope elevation in scope-recovery.
• typecheck, lint, check:docs-sections, check:destructive, check:fragments, and check:errors pass.
• The full unit suite passes except 6 permission-based tests (chmod/EACCES) in completions, upgrade, telemetry, code-scanner, and file-changes. Those fail the same way on main in my sandbox, so they're environment issues unrelated to this change.
• Not exercised against a live Sentry instance.

via BYK.

--

View Junior Session in Sentry

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sentry-local	Ready	Preview	Oct 30, 2026 4:21pm UTC

[BYK]

LGTM but will wait on @betegon's review before merging

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a206a7f. Configure here.}

[betegon]

just seeing this now, i'll get to it today!

[betegon]

found two things while reviewing and fixed them in ac0edfd:

• the table was splitting long tokens, breaking copy/paste. the token now prints intact on its own line.
• token commands could use the wrong saved account. we now select the org's account before checking scopes.

added regression coverage for both; all 77 targeted tests pass.