Machine Users
What a machine user is
Section titled “What a machine user is”A machine user is an organization-scoped identity for agents and CI. It signs in with a token, not a browser.
Create one in the dashboard, under Settings → Machine users. Reoclo shows the token (rk_m_…) at creation time only. Copy it before you close the dialog.
A machine user holds a role, the same as a human team member. The role decides what it can do. See Team and User Management for what each role allows.
Machine user or automation key?
Section titled “Machine user or automation key?”Reoclo has two credentials for machines. Pick the one that matches the job.
| Automation key | Machine user | |
|---|---|---|
| Scope | Narrow: a fixed set of operations | Full: an organization member with a role |
| Best for | A CI pipeline that does one thing | An agent that operates the platform |
| Environment variable | REOCLO_AUTOMATION_KEY | REOCLO_MACHINE_TOKEN |
| Token prefix | rca_ | rk_m_ |
Both can run reoclo run, on CLI 0.68.0 or later.
Authenticate
Section titled “Authenticate”Set REOCLO_MACHINE_TOKEN to the token, then run any command:
REOCLO_MACHINE_TOKEN=rk_m_... reoclo run -- ./task.shEach environment variable holds one credential class. REOCLO_AUTOMATION_KEY holds an automation key. REOCLO_MACHINE_TOKEN holds a machine user token. A token in the wrong variable makes the CLI exit with code 2.
Secrets
Section titled “Secrets”A machine user reads secrets through a grant, the same as an automation key. Open the secret project, go to its Access tab, and grant the machine user read.
A secret project that is restricted to specific servers cannot be read by a machine user. Use an automation key for that project instead.
Server scope
Section titled “Server scope”A machine user can carry a server scope, the same list of servers an automation key can carry. Leave it scoped to every server, unless you need to limit this machine user.
Server scope applies only to requests that name a server directly. It does not limit every operation, so it is not a full boundary.
Next steps
Section titled “Next steps”reoclo run: inject granted secrets into a command with a machine user token or an automation key- CI/CD automation: choosing a credential for a pipeline
- API Keys: automation keys, the narrower CI credential
- Team and User Management: the roles a machine user can hold