Create a token

Create a token in the InfluxDB UI

To create an InfluxDB API token in the InfluxDB UI, navigate to the API Tokens management page. In the navigation menu on the left, select Load Data > API Tokens.

• Create an all-access token
• Create a custom token
• Clone a token

Create an all-access token

1. From the API Tokens management page, click the Generate API Token button.
2. Select All Access API Token.

Create a custom token

1. From the API Tokens management page, click the Generate API Token button.
2. Select Custom API Token.
3. When the Generate a Personal API Token window appears, enter a description. If you don’t provide a description for the token, InfluxDB will generate a description from the permissions you assign. For example, if you select Read for a bucket named “_monitoring” and Write for a bucket named “_tasks”, InfluxDB will generate the description “Read buckets _monitoring Write buckets _tasks”.
4. Select the check boxes in the Read and Write columns to assign access permissions for the token. You can enable access to all buckets, individual buckets, Telegraf configurations, and other InfluxDB resources. By default, the new token has no access permissions.
5. When you’re finished, click Generate.
6. When InfluxDB displays the token value, click Copy to Clipboard. This is your only chance to access and copy the token value from InfluxDB.
7. (Optional) Store the API token value in a secure password vault.

Clone a token

To create a token with the same authorizations as an existing token, clone the existing token.

1. From the API Tokens management page, find the token you want to clone and click the icon located far right of the token description.
2. Select Clone.
3. When InfluxDB UI displays the created token, click Copy to Clipboard. This is your only chance to access and copy the token value from InfluxDB.
4. (Optional) Store the API token value in a secure password vault.

Create a token using the influx CLI

Use the influx auth create command to create a token. Include flags with the command to grant specific permissions to the token. See the available flags. Only tokens with the write: authorizations permission can create tokens.

Provide the following flags with the command:

• --token: API token with permission to create new tokens
• --org: Organization name
• Permission flags

influx auth create \
  --token 
API_TOKEN
 \
  --org 
ORG_NAME
 \
  --read-buckets \
  --write-buckets \
  --read-dbrps \
  --write-dbrps

Examples

• Create an all-access token
• Create a token with specific permissions
  • Create a token with specified read permissions
  • Create a token scoped to a user and with specified read and write permissions

Create an all-access token

Create an All-Access token to grant permissions to all resources in an organization.

influx auth create \
  --token 
API_TOKEN
 \
  --org 
ORG_NAME
 \
  --all-access

Create a token with specific permissions

Create a token with specified read permissions

influx auth create \
  --token 
API_TOKEN
 \
  --org 
ORG_NAME
 \
  --read-bucket 
BUCKET_ID
 \
  --read-bucket 
BUCKET_ID
 \
  --read-dashboards \
  --read-tasks \
  --read-telegrafs \
  --read-user

Create a token scoped to a user and with specified read and write permissions

influx auth create \
  --token 
API_TOKEN
 \
  --org 
ORG_NAME
 \
  --user 
USERNAME
 \
  --read-authorizations \
  --write-authorizations \
  --read-buckets \
  --write-buckets \
  --read-dashboards \
  --write-dashboards \
  --read-tasks \
  --write-tasks \
  --read-telegrafs \
  --write-telegrafs \
  --read-users \
  --write-users

See the influx auth create documentation for information about other available flags.

Create a token using the InfluxDB API

Use the /api/v2/authorizations InfluxDB API endpoint to create a token.

POST https://127.0.0.1:8086/api/v2/authorizations

Include the following in your request:

• Headers
  • Authorization: Token API_TOKEN (API token with the write: authorizations permission)
  • Content-type: application/json
• Request body: JSON object with the following properties:
  • status: Token status (active or inactive)
  • description: Token description
  • orgID: Organization ID
  • permissions: JSON array of objects, each with the following properties:
    • action: Authorized action (read or write)
    • resource: JSON object with the following properties
      • orgID: Organization ID
      • type: Resource type
      • name: (Optional) Resource name to scope permission to

curl --request POST \
  https://cloud2.influxdata.com/api/v2/authorizations \
  --header "Authorization: Token 
API_TOKEN
" \
  --header 'Content-type: application/json' \
  --data '{
  "status": "active",
  "description": "
AUTHORIZATION_DESCRIPTION
",
  "orgID": "
ORG_ID
",
  "permissions": [
    {
      "action": "read",
      "resource": {
        "orgID": "
ORG_ID
",
        "type": "authorizations"
      }
    },
    {
      "action": "read",
      "resource": {
        "orgID": "
ORG_ID
",
        "type": "buckets"
      }
    },
    {
      "action": "write",
      "resource": {
        "orgID": "
ORG_ID
",
        "type": "buckets",
        "name": "iot-center" 
      }
    }
  ]
}'

Create a token scoped to a user

To scope a token to a user other than the token creator, pass the userID property in the request body.

######################################################
# The example below uses common command-line tools 
# `curl`, `jq` with the InfluxDB API to do the following:
# 1. Create a user.
# 2. Find the new or existing user by name.
# 3. If the user exists:
#   a. Build an authorization object with the user ID.
#   b. Create the new authorization.
#   c. Return the new token.
######################################################

function create_token_with_user() {
  curl --request POST \
    "https://cloud2.influxdata.com/api/v2/users/" \
    --header "Authorization: Token 
API_TOKEN
" \
    --header 'Content-type: application/json' \
    --data "{\"name\": \"$1\"}"
  
  curl --request GET \
    "https://cloud2.influxdata.com/api/v2/users?name=$1" \
    --header "Authorization: Token 
API_TOKEN
" \
    --header 'Content-type: application/json' | \
  
  jq --arg USER $1 '.users[0] // error("User missing")
    | {
        "orgID": "
ORG_ID
",
        "userID": .id,
        "description": $USER,
        "permissions": [
           {"action": "read", "resource": {"type": "buckets"}}
         ]
      }' | \
  
  curl --request POST \
    "https://cloud2.influxdata.com/api/v2/authorizations" \
    --header "Authorization: Token 
API_TOKEN
" \
    --header 'Content-type: application/json' \
    --data @- | \
  
  jq '.token'
}

create_token_with_user 'iot_user_1'

See the POST /api/v2/authorizations documentation for more information about options.