Create and later revoke a Doppler Service Token scoped to a single project and config

Documented steps

1. Authenticate with a Personal Token or Service Account Token that has admin access to the project - Service Tokens cannot mint other tokens.
2. Create: POST https://api.doppler.com/v3/configs/config/tokens with body {"project":"my-project","config":"production","name":"ci-deploy","access":"read"}. project, config and name are required; access defaults to read and accepts read or read/write; expire_at (date-time) is optional.
3. Example: curl -X POST https://api.doppler.com/v3/configs/config/tokens -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"project":"my-project","config":"production","name":"ci-deploy","access":"read"}'
4. Capture the returned token value immediately - Doppler's docs state 'Copy the Service Token as it is only shown once.'
5. Equivalent CLI: doppler configs tokens create ci-deploy -p my-project -c production --access read --max-age 30d --plain
6. Revoke via API: DELETE https://api.doppler.com/v3/configs/config/tokens/token with body {"project":"my-project","config":"production","slug":"<token-slug>"}; the token's slug or full value identifies it.
7. Equivalent CLI: doppler configs tokens revoke -p my-project -c production <token>
8. Revocation takes effect immediately for new API and CLI requests using that token.
9. Official docs (verified 2026-07-29): https://docs.doppler.com/reference/service_tokens-create | https://docs.doppler.com/reference/service_tokens-delete | https://docs.doppler.com/docs/service-tokens