---
title: Manage management tokens
description: Manage management tokens in your InfluxDB Cloud Dedicated cluster. Management tokens grant permission to perform administrative actions such as managing users, databases, and database tokens.
url: https://docs.influxdata.com/influxdb3/cloud-dedicated/admin/tokens/management/
estimated_tokens: 1982
product: InfluxDB Cloud Dedicated
version: cloud-dedicated
---

# Manage management tokens

Management tokens grant permission to perform administrative actions such as managing users, databases, and database tokens in your InfluxDB Cloud Dedicated cluster.

Management tokens do *not* grant permissions to write or query time series data in your InfluxDB Cloud Dedicated cluster.

To grant write or query permissions, use management tokens to create [database tokens](/influxdb3/cloud-dedicated/admin/tokens/database/).

By default, management tokens are short-lived tokens issued by your identity provider for a [specific client session](/influxdb3/cloud-dedicated/reference/internals/security/#management-tokens-in-the-influxctl-cli) (for example, `influxctl`).

However, for automation purposes, you can manually create management tokens that authenticate directly with your InfluxDB Cluster and do not require human interaction with your identity provider. *Manually created management tokens provide full access to all account resources and aren’t affected by [user groups](/influxdb3/cloud-dedicated/reference/internals/security/#user-groups)*.

#### For automation use cases only

The tools outlined below are meant for automation use cases and shouldn’t be used to circumvent your identity provider or user group permissions. **Take great care when manually creating and using management tokens**.

InfluxDB Cloud Dedicated requires at least one [Admin user](/influxdb3/cloud-dedicated/reference/internals/security/#admin-user-group) associated with your cluster and authorized through your OAuth2 identity provider to manually create a management token.

-   [Create a management token](#create-a-management-token)
-   [List management tokens](#list-management-tokens)
-   [Revoke a management token](#revoke-a-management-token)

-   [Use a management token](#use-a-management-token)

## [Create a management token](/influxdb3/cloud-dedicated/admin/tokens/management/create/)

Use the Admin UI or the [`influxctl management create` command](/influxdb3/cloud-dedicated/reference/cli/influxctl/management/create) to manually create a management token.

```sh
influxctl management create \
  --expires-at $(date -v+1d -Iseconds) \
  --description "Example token description"
```

[Read more](/influxdb3/cloud-dedicated/admin/tokens/management/create/)

## [List management tokens](/influxdb3/cloud-dedicated/admin/tokens/management/list/)

Use the Admin UI or the [`influxctl management list` command](/influxdb3/cloud-dedicated/reference/cli/influxctl/management/list/) to list manually-created management tokens.

```sh
influxctl management list --format json
```

[Read more](/influxdb3/cloud-dedicated/admin/tokens/management/list/)

## [Revoke a management token](/influxdb3/cloud-dedicated/admin/tokens/management/revoke/)

Use the Admin UI or the [`influxctl management revoke` command](/influxdb3/cloud-dedicated/reference/cli/influxctl/management/revoke/) to revoke a management token and remove all access associated with the token. Provide the ID of the management token you want to revoke.

```sh
influxctl management revoke <TOKEN_ID>
```

[Read more](/influxdb3/cloud-dedicated/admin/tokens/management/revoke/)

## Use a management token

Use management tokens to automate authorization for the [`influxctl` CLI](/influxdb3/cloud-dedicated/reference/cli/influxctl/):

1. [Create a management token](#create-a-management-token) and securely store the output token value. You’ll use it in the next step.
2. On the machine where the `influxctl` CLI is to be automated, update your [`influxctl` connection profile](/influxdb3/cloud-dedicated/reference/cli/influxctl/#configure-connection-profiles) by assigning the `mgmt_token` setting to the token string from the preceding step.

```toml
[[profile]]
  name = "default"
  product = "dedicated"
  account_id = "ACCOUNT_ID"
  cluster_id = "CLUSTER_ID"
  mgmt_token = "MANAGEMENT_TOKEN"
```

Replace the following:

-   `ACCOUNT_ID`: InfluxDB Cloud Dedicated account ID
-   `CLUSTER_ID`: InfluxDB Cloud Dedicated cluster ID
-   `MANAGEMENT_TOKEN`: Management token string

#### Related

-   [InfluxDB Cloud Dedicated security](/influxdb3/cloud-dedicated/reference/internals/security/)