docs-v2

17 KiB

Raw Blame History

title

description

weight

list_code_example

alt_links

Create a resource token

Use the [`influxdb3 create token --permission` command](/influxdb3/enterprise/reference/cli/influxdb3/create/token/) or the [HTTP API](/influxdb3/enterprise/api/v3/) to create tokens that grant access to resources such as databases and system information. Database tokens allow for reading and writing data in your {{< product-name omit="Clustered" >}} instance. System tokens allow for reading system information and metrics for your server.

influxdb3_enterprise

parent
Resource tokens

201

##### CLI ```bash influxdb3 create token --permission \ --token ADMIN_TOKEN \ --expiry 1y \ --name "Read-write on DATABASE1, DATABASE2" \ db:DATABASE1,DATABASE2:read,write ``` ##### HTTP API "http://{{< influxdb/host >}}/api/v3/enterprise/configure/token" \ --header 'Accept: application/json' \ --header 'Content-Type: application/json' \ --header "Authorization: Bearer ADMIN_TOKEN" \ --data '{ "token_name": "Read-write for DATABASE1, DATABASE2", "permissions": [{ "resource_type": "db", "resource_identifier": ["DATABASE1","DATABASE2"], "actions": ["read","write"] }], "expiry_secs": 300000 }' ```

cloud-dedicated	cloud-serverless
/influxdb3/enterprise/admin/tokens/create-token/	/influxdb3/cloud-serverless/admin/tokens/create-token/

Use the influxdb3 create token --permission command or the /api/v3/configure/token HTTP API endpoint to create tokens that grant access to resources such as databases and system information. Database tokens allow for reading and writing data in your {{< product-name omit="Clustered" >}} instance. System tokens allow for reading system information and metrics for your server.

After you create an admin token, you can use the token string to authenticate influxdb3 commands and HTTP API requests for managing database and system tokens.

The HTTP API examples in this guide use cURL to send an API request, but you can use any HTTP client._

[!Note]

Store secure tokens in a secret store

Token strings are returned only on token creation. We recommend storing database tokens in a secure secret store. If you lose a resource token string, revoke the token and create a new one.

Create a database token

{{< tabs-wrapper >}} {{% tabs %}} influxdb3 HTTP API {{% /tabs %}} {{% tab-content %}}

Use the influxdb3 create token command to create a database token with permissions for reading and writing data in your {{% product-name %}} instance.

In your terminal, run the influxdb3 create token command and provide the following:

--permission flag to create a token with permissions
--name flag with a unique description of the token
Options, for example:
- --expiry option with the token expiration time as a duration. If an expiration isn't set, the token does not expire until revoked.
Token permissions (read and write) in the RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS format--for example:
- db:DATABASE1,DATABASE2:read,write
  - db:: The db resource type, which specifies the token is for a database.
  - DATABASE1,DATABASE2: The names of the databases to grant permissions to. The resource names part supports the * wildcard, which grants read or write permissions to all databases.
  - read,write: The permissions to grant to the token.

influxdb3 create token \
--permission \
--expiry 1y \
--name "Read-write on DATABASE1, DATABASE2" \
"db:DATABASE1,DATABASE2:read,write"

Replace the following:

{{% code-placeholder-key %}}DATABASE1{{% /code-placeholder-key %}}, {{% code-placeholder-key %}}DATABASE2{{% /code-placeholder-key %}}: your {{% product-name %}} database
{{% code-placeholder-key %}}1y{{% /code-placeholder-key %}}: the token expiration time as a duration.

The output is the token string in plain text.

Send a request to the following {{% product-name %}} endpoint:

{{% api-endpoint endpoint="http://{{< influxdb/host >}}/api/v3/enterprise/configure/token" method="post" %}}

Provide the following request headers:

Accept: application/json to ensure the response body is JSON content
Content-Type: application/json to indicate the request body is JSON content
Authorization: Bearer and the admin token for your instance to authorize the request

In the request body, provide the following parameters:

token_name: a description of the token, unique within the instance
resource_type: the resource type for the token, which is always db
resource_identifier: an array of database names to grant permissions to
- The resource identifier field supports the * wildcard, which grants read or write permissions to all databases.
permissions: an array of token permission actions ("read", "write") for the database
expiry_secs: Specify the token expiration time in seconds.

The following example shows how to use the HTTP API to create a database token:

  curl \
  "http://{{< influxdb/host >}}/api/v3/enterprise/configure/token" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
    "token_name": "Read-write for DATABASE1, DATABASE2",
    "permissions": [{
      "resource_type": "db",
      "resource_identifier": ["DATABASE1","DATABASE2"],
      "actions": ["read","write"]
     }],
     "expiry_secs": 300000
  }'

Replace the following in your request:

{{% code-placeholder-key %}}DATABASE1{{% /code-placeholder-key %}}, {{% code-placeholder-key %}}DATABASE2{{% /code-placeholder-key %}}: your {{% product-name %}} database
{{% code-placeholder-key %}}300000{{% /code-placeholder-key %}}: the token expiration time in seconds.

The response body contains token details, including the token field with the token string in plain text.

Examples

Create a token with read and write access to a database
Create a token with read and write access to all databases
Create a token with read-only access to a database
Create a token with read-only access to multiple databases
Create a token with mixed permissions to multiple databases
Create a token that expires in seven days

In the examples below, replace the following:

{{% code-placeholder-key %}}DATABASE_NAME{{% /code-placeholder-key %}}: your {{< product-name >}} database
{{% code-placeholder-key %}}DATABASE2_NAME{{% /code-placeholder-key %}}: your {{< product-name >}} database
{{% code-placeholder-key %}}ADMIN TOKEN{{% /code-placeholder-key %}}: the admin token for your {{% product-name %}} instance {{% code-placeholders "DATABASE_NAME|DATABASE2_NAME|ADMIN_TOKEN" %}}