Create a token

This page documents an earlier version of InfluxDB. InfluxDB v2.7 is the latest stable version. View this page in the v2.7 documentation.

Create API tokens using the InfluxDB user interface (UI), the influx command line interface (CLI), or the InfluxDB API.

Tokens are visible to the user who created the token. Users who own a token with Operator permissions also have access to all tokens. Tokens stop working when the user who created the token is deleted.

We recommend creating a generic user to create and manage tokens for writing data.

• Manage tokens in the InfluxDB UI
• Create a token in the InfluxDB UI
• Create a token using the influx CLI
• Create a token using the InfluxDB API

Manage tokens in the InfluxDB UI

To manage InfluxDB API Tokens in the InfluxDB UI, navigate to the API Tokens management page.

In the navigation menu on the left, select Data (Load Data) > Tokens.

Load Data

Create a token in the InfluxDB UI

1. From the API Tokens management page, click Generate and select a token type (Read/Write Token or All Access API Token).
2. In the window that appears, enter a description for your token in the Description field.
3. If generating a read/write token:
   • Search for and select buckets to read from in the Read pane.
   • Search for and select buckets to write to in the Write pane.
4. Click Save.

Create a token using the influx CLI

Use the influx auth create command to create a token. Include flags with the command to grant specific permissions to the token. See the available flags. Only tokens with the write: authorizations permission can create tokens.

# Syntax
influx auth create -o <org-name> [permission-flags]

Examples

Create an All-Access token

Create an All-Access token to grant permissions to all resources in an organization.

influx auth create \
  --org my-org \
  --all-access

Create an Operator token

Create an Operator token to grant permissions to all resources in all organizations.

influx auth create \
  --org my-org \
  --operator

Create a token with specified read permissions

influx auth create \
  --org my-org \
  --read-bucket 03a2bbf46309a000 \
  --read-bucket 3a87c03ace269000 \
  --read-dashboards \
  --read-tasks \
  --read-telegrafs \
  --read-user

See the influx auth create documentation for information about other available flags.

Create a token using the InfluxDB API

Use the /api/v2/authorizations InfluxDB API endpoint to create a token.

POST http://localhost:8086/api/v2/authorizations

Include the following in your request:

INFLUX_ORG_ID=YOUR_ORG_ID
INFLUX_TOKEN=YOUR_API_TOKEN
curl -v --request POST \
  http://localhost:8086/api/v2/authorizations \
  --header "Authorization: Token ${INFLUX_TOKEN}" \
  --header 'Content-type: application/json' \
  --data '{
  "status": "active",
  "description": "iot-center-device",
  "orgID": "'"${INFLUX_ORG_ID}"'",
  "permissions": [
    {
      "action": "read",
      "resource": {
        "orgID": "'"${INFLUX_ORG_ID}"'",
        "type": "authorizations"
      }
    },
    {
      "action": "read",
      "resource": {
        "orgID": "'"${INFLUX_ORG_ID}"'",
        "type": "buckets"
      }
    },
    {
      "action": "write",
      "resource": {
        "orgID": "'"${INFLUX_ORG_ID}"'",
        "type": "buckets",
        "name": "iot-center" 
      }
    }
  ]
}'

Create a token scoped to a user

To scope a token to a user other than the token creator, pass userID in the request body.

######################################################
# The example below uses common command-line tools 
# `curl`, `jq` with the InfluxDB API to do the following:
# 1. Create a user.
# 2. Find the new or existing user by name.
# 3. If the user exists:
#   a. Build an authorization object with the user ID.
#   b. Create the new authorization.
#   c. Return the new token.
######################################################
INFLUX_ORG_ID=YOUR_ORG_ID
INFLUX_TOKEN=YOUR_API_TOKEN
function create_token_with_user() {
  curl --request POST \
    "http://localhost:8086/api/v2/users/" \
    --header "Authorization: Token ${INFLUX_TOKEN}" \
    --header 'Content-type: application/json' \
    --data "{\"name\": \"$1\"}"
  curl --request GET \
    "http://localhost:8086/api/v2/users?name=$1" \
    --header "Authorization: Token ${INFLUX_TOKEN}" \
    --header 'Content-type: application/json' | \
  jq --arg USER $1 '.users[0] // error("User missing")
    | {
        "orgID": "'"${INFLUX_ORG_ID}"'",
        "userID": .id,
        "description": $USER,
        "permissions": [
           {"action": "read", "resource": {"type": "buckets"}}
         ]
      }' | \
  curl --request POST \
    "http://localhost:8086/api/v2/authorizations" \
    --header "Authorization: Token ${INFLUX_TOKEN}" \
    --header 'Content-type: application/json' \
    --data @- | \
  jq '.token'
}
create_token_with_user 'iot_user_1'

See the POST /api/v2/authorizations documentation for more information about options.