Documentation

chronoctl token

The token command reads a private token file, generates and signs the nonce, and then returns an expiring token to be used in the Authorization header. For example:

Authorization: CHRONOGRAF-SHA256 <returned-expiring-token>

Usage

chronoctl token [flags]

Flags

FlagDescriptionEnv. Variable
-h--helpOutput command help
--chronograf-urlChronograf’s URL (default is http://localhost:8888)CHRONOGRAF_URL
-k--skip-verifySkip TLS certification verification
--priv-key-filePrivate key file location for superadmin token authenticationPRIV_KEY_FILE

Examples

The following example uses the RSA key used when started the Chronograf server and returns an expiring token that can be used to gain superadmin access to Chronograf.

The private key must correspond to the public key used when starting the Chronograf server.

chronoctl token --priv-key-file /path/to/chronograf-rsa

Was this page helpful?

Thank you for your feedback!


New in InfluxDB 3.6

Key enhancements in InfluxDB 3.6 and the InfluxDB 3 Explorer 1.4.

See the Blog Post

InfluxDB 3.6 is now available for both Core and Enterprise. This release introduces the 1.4 update to InfluxDB 3 Explorer, featuring the beta launch of Ask AI, along with new capabilities for simple startup and expanded functionality in the Processing Engine.

For more information, check out:

InfluxDB Docker latest tag changing to InfluxDB 3 Core

On February 3, 2026, the latest tag for InfluxDB Docker images will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments.

If using Docker to install and run InfluxDB, the latest tag will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments. For example, if using Docker to run InfluxDB v2, replace the latest version tag with a specific version tag in your Docker pull command–for example:

docker pull influxdb:2