101 lines
4.4 KiB
Markdown
101 lines
4.4 KiB
Markdown
Use the `influxdb3` CLI or the HTTP API to regenerate the operator (`_admin`) token for your {{% product-name %}} instance.
|
|
Regenerate a token to rotate it as part of your security practices or if you suspect
|
|
the token has been compromised.
|
|
|
|
Regenerating the operator token deactivates the previous token,
|
|
stores the SHA512 hash and metadata of the new token, and returns the new token string.
|
|
|
|
## Prerequisite
|
|
|
|
To regenerate an operator token, you need the current token string.
|
|
|
|
## Use the CLI or HTTP API to regenerate the operator token
|
|
|
|
> [!Important]
|
|
> #### Regenerating the operator token
|
|
> Regenerating the operator token invalidates the previous token.
|
|
> Make sure to update any applications or scripts that use the operator token.
|
|
|
|
To regenerate the operator token, use the [`influxdb3 serve create token` command](/influxdb3/version/reference/cli/influxdb3/create/token/) (CLI) or the
|
|
[`/api/v3/configure/token/admin/regenerate` endpoint](/influxdb3/version/api/v3/configure/token/admin/regenerate) (HTTP API):
|
|
|
|
{{< tabs-wrapper >}}
|
|
{{% tabs %}}
|
|
[CLI](#cli-regenerate)
|
|
[HTTP API](#http-api-regenerate)
|
|
{{% /tabs %}}
|
|
{{% tab-content %}}
|
|
<!---------------------------------BEGIN CLI----------------------------------->
|
|
Use the `--regenerate` flag with the
|
|
[`influxdb3 create token --admin`](/influxdb3/version/reference/cli/influxdb3/create/token/) subcommand--for example:
|
|
|
|
{{% code-placeholders "OPERATOR_TOKEN" %}}
|
|
```bash
|
|
influxdb3 create token --admin \
|
|
--regenerate
|
|
OPERATOR_TOKEN
|
|
```
|
|
{{% /code-placeholders %}}
|
|
|
|
In your command,
|
|
replace {{% code-placeholder-key %}}`OPERATOR_TOKEN`{{% /code-placeholder-key %}}
|
|
with the current operator (`_admin`) token string.
|
|
|
|
The output contains the new token string and InfluxDB deactivates the previous token string.
|
|
<!----------------------------END CLI------------------------------------------>
|
|
{{% /tab-content %}}
|
|
{{% tab-content %}}
|
|
<!----------------------------BEGIN HTTP API----------------------------------->
|
|
Use the following HTTP API endpoint:
|
|
|
|
{{% api-endpoint method="POST" endpoint="/api/v3/configure/token/admin/regenerate" api-ref="/influxdb3/version/api/v3/configure/token/admin/regenerate" %}}
|
|
|
|
In your request, send an `Authorization` header with your current operator token string
|
|
--for example:
|
|
|
|
{{% code-placeholders "OPERATOR_TOKEN" %}}
|
|
```bash
|
|
curl -X POST "http://{{< influxdb/host >}}/api/v3/configure/token/admin/regenerate" \
|
|
--header "Authorization: Bearer OPERATOR_TOKEN" \
|
|
--header "Accept: application/json"
|
|
```
|
|
{{% /code-placeholders %}}
|
|
|
|
In your command, replace {{% code-placeholder-key %}}`OPERATOR_TOKEN`{{% /code-placeholder-key %}} with the current token string.
|
|
|
|
The response body contains the new operator token string in plain text, and InfluxDB deactivates the previous token string.
|
|
<!------------------------END HTTP API ---------------------------------------->
|
|
{{% /tab-content %}}
|
|
{{< /tabs-wrapper >}}
|
|
|
|
To use the token as the default for later commands, and to persist the token
|
|
across sessions, assign the token string to the `INFLUXDB3_AUTH_TOKEN` environment variable.
|
|
|
|
## Lost admin token recovery
|
|
|
|
If you've lost your admin token and cannot regenerate it using the standard method, you can use the admin token recovery server:
|
|
|
|
1. Start {{< product-name >}} with the `--admin-token-recovery-http-bind` option:
|
|
```bash
|
|
influxdb3 serve --admin-token-recovery-http-bind
|
|
```
|
|
|
|
2. In a separate terminal, regenerate the admin token using the recovery endpoint:
|
|
|
|
```bash
|
|
influxdb3 create token --admin --regenerate --host http://127.0.0.1:8182
|
|
```
|
|
|
|
3. The recovery server automatically shuts down after successful token regeneration.
|
|
|
|
> [!Warning]
|
|
> The recovery server provides unauthenticated access to regenerate admin tokens. Only use this option when necessary and ensure the recovery endpoint (by default `127.0.0.1:8182`) is only accessible from trusted networks.
|
|
|
|
## Important considerations
|
|
|
|
- Regenerating the operator token invalidates the previous token.
|
|
- If you lose the operator token, use the recovery server method described above.
|
|
- `--regenerate` only works for the operator token. You can't use the `--regenerate` flag with the `influxdb3 create token --admin` command to regenerate a named admin token.
|
|
- Ensure that you update any applications or scripts that use the operator token with the new token string.
|
|
- Always store your operator token securely and consider implementing proper secret management practices.
|