Rotating Agora credentials

These instructions explain how to rotate Identity Tokens and replace API keys managed at agora.dequecloud.com. This includes Agora credentials stored in:

• .npmrc and .yarnrc.yml
• Docker logins
• Maven settings.xml
• nuget.config
• pip.conf
• Bundler config
• Gradle properties
• CI secrets
• Configuration in your own Artifactory or Nexus instance that proxies to Agora

This does not include Axe Account credentials or Axe Account API keys managed at https://axe.deque.com/settings. Those are separate from Agora Identity Tokens.

Rotation generally consists of:

1. Generate a new Identity Token.
2. Put it everywhere listed above, in place of the old token, API key, or auth string.
3. Revoke the old Identity Token from Edit Profile in Agora.

Quick reference

Support for Agora API keys ended in February 2026, so Agora no longer accepts them. Replace any you still have with an Identity Token.

Signing in to Agora

Go to https://agora.dequecloud.com/. Agora sends you to auth.deque.com to sign in with your Axe Account, the same one you use for axe DevTools at https://axe.deque.com. If your organization signs in to Axe Account through its own SSO, Agora uses that too.

Generate a new Identity Token

1. Sign in to Agora.
2. Select the Welcome, your-email-address button in the top bar, then select Edit Profile. You can also go straight to https://agora.dequecloud.com/ui/admin/artifactory/user_profile.
3. Select Generate an Identity Token. Optionally add a description, such as "laptop npm" or "GitHub Actions", then select Next.
4. Copy the token now. This is your only chance to see its value.

Wherever a tool asks for a username and password, use your Axe Account email as the username and the Identity Token as the password.

npm and Yarn

Your .npmrc lines for Agora contain the token itself. The _auth string is an encoded copy of your email and token, so it needs regenerating too.

Easiest: paste your email and new Identity Token into the Configuring Access to Agora packages tool. Then replace the Agora lines in your .npmrc with the ones it gives you.

By hand: generate a new auth string:

curl -u "your-email:your-identity-token" "https://agora.dequecloud.com/artifactory/api/npm/auth"

Then replace the old _auth value for each Agora registry in your .npmrc, usually devtools-npm or dequelabs:

@axe-devtools:registry=https://agora.dequecloud.com/artifactory/api/npm/devtools-npm/
//agora.dequecloud.com/artifactory/api/npm/devtools-npm/:_auth=<new auth string>
//agora.dequecloud.com/artifactory/api/npm/devtools-npm/:email=<your-email>
//agora.dequecloud.com/artifactory/api/npm/devtools-npm/:always-auth=true

If you use _authToken, set it to the new Identity Token instead:

//agora.dequecloud.com/artifactory/api/npm/dequelabs/:_authToken=<new identity token>

Yarn 2 and later: update npmAuthIdent (or npmAuthToken) for the Agora scope in .yarnrc.yml.

In CI: update the secret your pipeline writes into .npmrc.

Docker

If you pull images from agora.dequecloud.com:1083, such as the axe DevTools Linter image, log in again. Use your Axe Account email and your new Identity Token, not an API key:

docker logout agora.dequecloud.com:1083
docker login agora.dequecloud.com:1083 -u <your-email> --password-stdin

Paste the Identity Token, press Enter, then press Ctrl+D (Ctrl+Z then Enter on Windows).

In CI, update the secret your docker login step uses.

Image tars that you download and docker load work like any other download. See Downloads with curl, scripts, and CI.

Maven, Gradle, NuGet, PyPI, and Ruby gems

In each case, replace the old Identity Token or API key with the new Identity Token:

• Maven: in ~/.m2/settings.xml, the <password> of the <server> whose <id> is deque.

• Gradle (axe DevTools Mobile): agora_identity_token in your Gradle properties. If you still have artifactory_apikey from older instructions, switch it to an Identity Token.

• NuGet:

  • With nuget.config, update ClearTextPassword under packageSourceCredentials for the Agora source.
  • In Visual Studio, remove the saved credential for agora.dequecloud.com from Windows Credential Manager, then sign in again with the new token when prompted.
  • If you used an encrypted password, replace it too.

• PyPI: update the token in the devtools-python index URL in pip.conf, or in PIP_EXTRA_INDEX_URL. If your email contains @, URL-encode it as %40.

• Ruby gems:

  bundle config agora.dequecloud.com <your-email>:<new identity token>

Service accounts and repository managers

If your Artifactory or Nexus instance proxies Agora, or your CI uses a dedicated Agora service account:

1. Get a new Identity Token for the service account. The account's owner can generate one; otherwise, ask Deque to issue one, as when the account was set up.
2. Update the credential stored in the remote or proxy repository, or in the CI secret. See Set up your Artifactory or Set up your Nexus.
3. Clear the repository manager's cache of failed requests if it cached 401 responses while its credential was out of date.

Downloads with curl, scripts, and CI

Replace the old token or API key in every script and CI secret, such as AGORA_IDENTITY_TOKEN. Scripts that send it in the X-JFrog-Art-Api header keep working once that value is a new Identity Token:

curl -H "X-JFrog-Art-Api: $AGORA_IDENTITY_TOKEN" -O \
  "https://agora.dequecloud.com/artifactory/<repo>/<path-to-file>"

Authorization: Bearer $AGORA_IDENTITY_TOKEN works too.

Need help?

Contact your Deque representative directly, or submit a support request through the Deque Help Center. Include your Axe Account email and the tool you're using.