# How agencies can use separate CLI tokens for each client workspace

> Keep agency automation isolated with one workspace-bound DunSocial CLI token and one explicit account map for every client you manage.

- Published: 2026-08-06
- Last updated: 2026-08-06
- Author: DunSocial
- Topics: cli, how-to

---

A single universal credential is convenient until a job targets the wrong client. DunSocial personal access tokens are bound to one workspace, so build the automation around that boundary.

Each client job should load one token, one workspace ID and an allow-list of that client’s social account IDs.

Search phrases: DunSocial CLI agencies, separate client API tokens, agency social media automation, workspace bound PAT, multi client social media CLI.

## What you will do

- Create separate client credentials.
- Keep secrets out of scripts and logs.
- Stop a run when workspace identity does not match the client.

## Before you start

- Node.js 20 or newer and the DunSocial CLI installed with `npm install -g dunsocial`.
- A selected workspace and the DunSocial account IDs returned by `dun accounts list`.
- Browser login for a laptop, or a workspace-bound token stored in a secret manager for automation.

## Step by step

### 1. Create a token inside each client workspace

Open Settings → CLI in the client workspace. Choose only the scopes the job needs and copy the secret once into your secret manager.

### 2. Name secrets by client and environment

Use unambiguous secret names such as `LUMEN_DUN_TOKEN` and `LUMEN_DUN_WORKSPACE_ID`. Do not keep live secrets in a shared content spreadsheet.

### 3. Assert identity before writes

Load one client secret set, run auth and workspace status with JSON, and stop if the returned workspace differs from the expected ID.

```
DUN_TOKEN="$CLIENT_DUN_TOKEN" \
DUN_WORKSPACE_ID="$CLIENT_WORKSPACE_ID" \
dun auth status --json
```

### 4. Run the client command

Use only account IDs from that client’s reviewed configuration. Clear job-scoped variables when the run ends.

## Check before you finish

- `dun workspace current` shows the intended workspace before a write command.
- The command uses DunSocial account IDs rather than social @handles.
- The new item appears in DunSocial with the expected CLI source, copy and time.
- No job can fall back to a personal default workspace when a client variable is missing.

## Where to go next

Use the queue-audit guide to produce a client report without combining credentials or content inside one process context.

---

## About this document

This is the Markdown representation of https://www.dunsocial.com/blog/use-separate-dunsocial-cli-tokens-for-each-agency-client. The HTML version of the same page is at the same URL. You can also request Markdown from any page by sending `Accept: text/markdown`.

Machine-readable summary of the whole site: https://www.dunsocial.com/llms.txt

## Company

- Product: DunSocial, https://www.dunsocial.com
- Legal entity: THISUX PRIVATE LIMITED, Chennai, Tamil Nadu, India
- Support: support@dunsocial.com
- Open the app: https://app.dunsocial.com/login