--- title: Database tokens description: Create and manage database tokens that authorize read and write access to InfluxDB 3 Cloud Dedicated databases. url: https://docs.influxdata.com/influxdb3/cloud-dedicated/api/management-api/database-tokens/ estimated_tokens: 2564 product: InfluxDB 3 Cloud version: cloud publisher: InfluxData canonical: https://docs.influxdata.com/influxdb3/cloud-dedicated/api/management-api/database-tokens/ --- [Download Cloud Dedicated Management API Spec](/openapi/influxdb-cloud-dedicated-management-api.yml) Create and manage database tokens that authorize read and write access to InfluxDB 3 Cloud Dedicated databases. GET`/accounts/{accountId}/clusters/{clusterId}/tokens` ### Get all database tokens for a cluster #### Parameters ##### Path parameters `accountId`requiredstring The ID of the account to get the database tokens for `clusterId`requiredstring The ID of the cluster to get the database tokens for Example request[Ask AI about this](#) ```sh curl --request GET \ "https://console.influxdata.com/api/v0/accounts/{accountId}/clusters/{clusterId}/tokens" \ --header "Authorization: Bearer INFLUX_TOKEN" ``` #### Responses 200The database tokens were successfully retrieved 400Bad Request `code`requiredinteger `message`requiredstring 401Unauthorized `code`requiredinteger `message`requiredstring 403Forbidden `code`requiredinteger `message`requiredstring 404Not Found `code`requiredinteger `message`requiredstring 500Internal Server Error `code`requiredinteger `message`requiredstring POST`/accounts/{accountId}/clusters/{clusterId}/tokens` ### Create a database token Create a database token for a cluster. The token returned on the `accessToken` property in the response can be used to authenticate query and write requests to the cluster. ### Notable behaviors * InfluxDB might take some time–from a few seconds to a few minutes–to activate and synchronize new tokens. If a new database token doesn’t immediately work (you receive a `401 Unauthorized` error) for querying or writing, wait and then try your request again. * Token strings are viewable *only* on token creation and aren’t stored by InfluxDB; you can’t recover a lost token. #### Store secure tokens in a secret store We recommend storing database tokens in a **secure secret store**. For example, see how to authenticate Telegraf using tokens in your OS secret store. If you lose a token, delete the token from InfluxDB and create a new one. #### Parameters ##### Path parameters `accountId`requiredstring The ID of the account to create the database token for `clusterId`requiredstring The ID of the cluster to create the database token for #### Request bodyrequired Content-Type:`application/json` `description`requiredstring The description of the database token `expiresAt`string The date and time that the database token expires, if applicable Uses RFC3339 format `permissions`object[] The list of permissions the database token allows `action`string The action the database token permission allows `resource`string The resource the database token permission applies to Example request[Ask AI about this](#) ```sh curl --request POST \ "https://console.influxdata.com/api/v0/accounts/{accountId}/clusters/{clusterId}/tokens" \ --header "Authorization: Bearer INFLUX_TOKEN" \ --header "Content-Type: application/json" \ --data-raw '{ "description": "DESCRIPTION", "expiresAt": "EXPIRESAT", "permissions": [ { "action": "ACTION", "resource": "RESOURCE" } ] }' ``` #### Responses 200The database token was successfully created `accessToken`requiredstring The access token that can be used to authenticate query and write requests to the cluster The access token is never stored by InfluxDB and is only returned once when the token is created. If the access token is lost, a new token must be created. `accountId`requiredstring \ `clusterId`requiredstring \ `createdAt`requiredstring The date and time that the database token was created Uses RFC3339 format `description`requiredstring The description of the database token `expiresAt`string The date and time that the database token expires, if applicable Uses RFC3339 format `id`requiredstring \ `permissions`requiredobject[] The list of permissions the database token allows `action`string The action the database token permission allows `resource`string The resource the database token permission applies to `revokedAt`string The date and time that the database token was revoked, if applicable Uses RFC3339 format 400Bad Request `code`requiredinteger `message`requiredstring 401Unauthorized `code`requiredinteger `message`requiredstring 403Forbidden `code`requiredinteger `message`requiredstring 404Not Found `code`requiredinteger `message`requiredstring 409Conflict `code`requiredinteger `message`requiredstring 500Internal Server Error `code`requiredinteger `message`requiredstring GET`/accounts/{accountId}/clusters/{clusterId}/tokens/{tokenId}` ### Get a database token Retrieve metadata details for a database token. #### Store secure tokens in a secret store We recommend storing database tokens in a **secure secret store**. Token strings are viewable *only* on token creation and aren’t stored by InfluxDB; you can’t recover a lost token. #### Parameters ##### Path parameters `accountId`requiredstring The ID of the account that the database token belongs to `clusterId`requiredstring The ID of the cluster that the database token belongs to `tokenId`requiredstring The ID of the database token to get Example request[Ask AI about this](#) ```sh curl --request GET \ "https://console.influxdata.com/api/v0/accounts/{accountId}/clusters/{clusterId}/tokens/{tokenId}" \ --header "Authorization: Bearer INFLUX_TOKEN" ``` #### Responses 200The database token was successfully retrieved. `accountId`requiredstring \ `clusterId`requiredstring \ `createdAt`requiredstring The date and time that the database token was created Uses RFC3339 format `description`requiredstring The description of the database token `expiresAt`string The date and time that the database token expires, if applicable Uses RFC3339 format `id`requiredstring \ `permissions`requiredobject[] The list of permissions the database token allows `action`string The action the database token permission allows `resource`string The resource the database token permission applies to `revokedAt`string The date and time that the database token was revoked, if applicable Uses RFC3339 format 400Bad Request `code`requiredinteger `message`requiredstring 401Unauthorized `code`requiredinteger `message`requiredstring 403Forbidden `code`requiredinteger `message`requiredstring 404Not Found `code`requiredinteger `message`requiredstring 500Internal Server Error `code`requiredinteger `message`requiredstring PATCH`/accounts/{accountId}/clusters/{clusterId}/tokens/{tokenId}` ### Update a database token Update the description and permissions of a database token. #### Parameters ##### Path parameters `accountId`requiredstring The ID of the account that the database token belongs to `clusterId`requiredstring The ID of the cluster that the database token belongs to `tokenId`string The ID of the database token to update #### Request bodyrequired Content-Type:`application/json` `description`string The description of the database token `permissions`object[] The list of permissions the database token allows `action`string The action the database token permission allows `resource`string The resource the database token permission applies to Example request[Ask AI about this](#) ```sh curl --request PATCH \ "https://console.influxdata.com/api/v0/accounts/{accountId}/clusters/{clusterId}/tokens/{tokenId}" \ --header "Authorization: Bearer INFLUX_TOKEN" \ --header "Content-Type: application/json" \ --data-raw '{ "description": "DESCRIPTION", "permissions": [ { "action": "ACTION", "resource": "RESOURCE" } ] }' ``` #### Responses 200The database token was successfully updated `accountId`requiredstring \ `clusterId`requiredstring \ `createdAt`requiredstring The date and time that the database token was created Uses RFC3339 format `description`requiredstring The description of the database token `expiresAt`string The date and time that the database token expires, if applicable Uses RFC3339 format `id`requiredstring \ `permissions`requiredobject[] The list of permissions the database token allows `action`string The action the database token permission allows `resource`string The resource the database token permission applies to `revokedAt`string The date and time that the database token was revoked, if applicable Uses RFC3339 format 400Bad Request `code`requiredinteger `message`requiredstring 401Unauthorized `code`requiredinteger `message`requiredstring 403Forbidden `code`requiredinteger `message`requiredstring 404Not Found `code`requiredinteger `message`requiredstring 409Conflict `code`requiredinteger `message`requiredstring 500Internal Server Error `code`requiredinteger `message`requiredstring DELETE`/accounts/{accountId}/clusters/{clusterId}/tokens/{tokenId}` ### Delete a database token #### Parameters ##### Path parameters `accountId`requiredstring The ID of the account that the database token belongs to `clusterId`requiredstring The ID of the cluster that the database token belongs to `tokenId`requiredstring The ID of the database token to delete Example request[Ask AI about this](#) ```sh curl --request DELETE \ "https://console.influxdata.com/api/v0/accounts/{accountId}/clusters/{clusterId}/tokens/{tokenId}" \ --header "Authorization: Bearer INFLUX_TOKEN" ``` #### Responses 204No Content 400Bad Request `code`requiredinteger `message`requiredstring 401Unauthorized `code`requiredinteger `message`requiredstring 403Forbidden `code`requiredinteger `message`requiredstring 404Not Found `code`requiredinteger `message`requiredstring 500Internal Server Error `code`requiredinteger `message`requiredstring #### Related * [Manage database tokens](/influxdb3/cloud-dedicated/admin/tokens/database/) * [Delete a database token](/influxdb3/cloud-dedicated/admin/tokens/database/delete/) * [Authenticate Telegraf using tokens in your OS secret store](https://github.com/influxdata/telegraf/tree/master/plugins/secretstores/os) * [InfluxDB 3 API client libraries](/influxdb3/cloud-dedicated/reference/client-libraries/v3/)