# Manual sessions

> Create a publish session in the web UI and use its token with curl or a build tool.

Source: https://docs.telesphorepo.com/publishing/manual-sessions/

A manual session lets you publish from any machine, without a plugin, a device or a CI trust policy. You sign in to the web UI, prove a second factor, and copy a token. The token works for 15 minutes by default.

## Create a session

1. Open the server in a browser and sign in.
2. Open the **Publishing** page.
3. Choose the repository. Press “New publish session”.
4. Enter a fresh TOTP code, or confirm with a passkey. A recovery code does not work here.
5. Copy the token. It starts with `trs_`.

You need a second factor on your account. Add one on the **Security** page first. See [Accounts and 2FA](/security/accounts-and-2fa/). You also need the `write` permission on the repository.

The page shows ready-made snippets for the repository. Use the token as the password. Any user name works.

## Use the token

- curl (Maven)

  ```sh
  curl -f -u publish:trs_TOKEN -T app-1.0.jar \
    https://repo.acme.com/maven/releases/com/acme/app/1.0/app-1.0.jar
  ```

- curl (raw)

  ```sh
  curl -f -u publish:trs_TOKEN -T file.tar.gz \
    https://repo.acme.com/raw/files/path/file.tar.gz
  ```

- curl (Debian)

  ```sh
  curl -u publish:trs_TOKEN -T app_1.0_amd64.deb \
    https://repo.acme.com/debian/apt/upload/stable/main
  ```

- Maven

  ```xml title="~/.m2/settings.xml"
  <server>
    <id>telesphorepo</id>
    <username>publish</username>
    <password>trs_TOKEN</password>
  </server>
  ```

- Gradle

  ```kotlin title="build.gradle.kts"
  publishing {
      repositories {
          maven {
              url = uri("https://repo.acme.com/maven/releases")
              credentials {
                  username = "publish"
                  password = "trs_TOKEN"
              }
          }
      }
  }
  ```

Debian indexes rebuild after the `deb.debounce` time. See [Debian](/repositories/debian/).

## End a session early

The token ends itself after 15 minutes. To end it sooner, send a `DELETE` with the same token:

```sh
curl -f -X DELETE -u publish:trs_TOKEN https://repo.acme.com/api/publish/sessions/SESSION_ID
```

Your own sessions are at `GET /api/publish/sessions`. See [HTTP API](/reference/http-api/).

## Gotchas

- Remove the token from `settings.xml` or `build.gradle.kts` after the publish. It expires soon, but it is still a working credential.
- A token works for one repository only.
- The time limit is `publish.session_ttl`. An admin can set it up to 1 hour.
- If the token expires during a long upload series, create a new session.
- Wrong second-factor codes count toward the rate limit. After too many, the server answers 429 with a `Retry-After` header.
- A read token or another publish session token cannot create a session.