Hello, We are in the process of configuring Pactflow webhooks to trigger github actions workflow. For authentication, I see there are two options where one is personal access token and the other is github app. Github app provides shortlived tokens whereas personal access token provides custom range for expiration. Is there a different way to have token created with custom expiration for entire org instead of using personal access token ? Interested to understand how everyone is using it

For now, you will need to use a PAT or at least, you will need to give PactFlow a token that it can use (as a secret). There are APIs to manage secrets, so if you wanted to rotate them by some other process (e.g. a lambda / function that’s job is to create new tokens from GitHub, and update the secret in PactFlow), that could work

Thanks Matt, we are trying to avoid PAT as this will be used by org level and will impose a security risk for the user. Can you provide the api info for updating secrets ?

We’ll be publishing our APIs in the next ~month or so, but from the PactFlow UI if you head to the secrets page, open the network tab and you should be able to copy the XHR calls. They are quite basic, from memory

cool thanks Matt