> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuon.co/llms.txt
> Use this file to discover all available pages before exploring further.

# 044 - Scoped Credentials and Drift Resolution

> Service account tokens for CI and per-job runner credentials. Redeploy any component a drift scan flags.

*October 30, 2026*

## Scoped credentials

* [Service account tokens](https://docs.nuon.co/concepts/api-tokens.md) replace personal tokens for API and CI access, each with one role in one org
* Runners use short-lived credentials, scoped to each job

Move CI and scripts to service account tokens. Personal tokens keep working until you revoke them.

> [card] [Nuon's security model](https://docs.nuon.co/security.md)

***

## One-click drift fixes

* See [drift](https://docs.nuon.co/concepts/workflows.md#drift-detection) and undeployed changes together on each install
* Redeploy just the component that drifted

![An install's Components page with Changes not applied and State drift detected groups, each resource showing a Resolve drift button](https://mintcdn.com/nuoninc/vCZNVFv1DjPx3nVQ/images/changelog/044-drift.png?fit=max\&auto=format\&n=vCZNVFv1DjPx3nVQ\&q=85\&s=bbe753e6f560571909974fea2dbe72de)

> [card] [Drift detection docs](https://docs.nuon.co/concepts/workflows.md#drift-detection)

***

## Other updates in this release

### Upgrade the CLI

CLI login got a security update, so `nuon auth login` fails on versions older than v0.19.1261. Run `brew upgrade nuonco/tap/nuon`.

### More accurate change previews

Change previews now catch edits in nested settings, like deployment options, health checks, permissions, secrets, actions and runbooks.

### Skip applies with policies

Give a policy check `custom.action: skip_apply`, and Nuon skips the apply for any Terraform component or sandbox it matches. Components that depend on it still get its last outputs.

> [card] [Configuring policies](https://docs.nuon.co/guides/configuring-policies.md)

### Pull request previews

See what a pull request would change before you merge it. Each open pull request on an app branch gets a page with its config diff, commit, and preview step status.

> [!NOTE]
>
> Pull request previews are in early access. [Contact us](https://nuon.co/contact-us) to turn them on for your org.

### CLI versions for BYOC control planes

If you run a Nuon BYOC control plane in your own cloud, [install the CLI version that matches it alongside the latest](https://docs.nuon.co/guides/cli-versions.md).

The control plane can also [set the oldest CLI it accepts](https://docs.nuon.co/cli#version-warnings). Teammates and CI on an older CLI get a warning or an error that names the version to install.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.