---
title: Manage resource tokens
description: Manage resource tokens in your InfluxDB 3 Enterprise instance. Resource tokens grant permissions on specific resources, such as databases and system information endpoints in your InfluxDB 3 Enterprise instance. Database resource tokens allow for actions like writing and querying data.
url: https://docs.influxdata.com/influxdb3/enterprise/admin/tokens/resource/
estimated_tokens: 1440
product: InfluxDB 3 Enterprise
version: enterprise
---

# Manage resource tokens

Manage resource tokens in your InfluxDB 3 Enterprise instance. Resource tokens provide scoped access to specific resources:

-   **Database tokens**: provide access to specific databases for actions like writing and querying data
-   **System tokens**: provide access to system-level resources, such as API endpoints for server runtime statistics and health.

Resource tokens are user-defined and available only in InfluxDB 3 Enterprise.

### [Create a resource token](/influxdb3/enterprise/admin/tokens/resource/create/)

Use the [`influxdb3 create token --permission` command](/influxdb3/enterprise/reference/cli/influxdb3/create/token/) or the [HTTP API](/influxdb3/enterprise/api/v3/) to create fine-grained permissions tokens that grant access to resources such as databases and system information. Database tokens allow for reading and writing data in your InfluxDB 3 Enterprise instance. System tokens allow for reading system information and metrics for your server.

##### CLI

```bash
influxdb3 create token \
  --permission "db:DATABASE1,DATABASE2:read,write" \
  --name "Read-write on DATABASE1, DATABASE2" \
  --token ADMIN_TOKEN \
  --expiry 1y
```

##### HTTP API

```bash
curl \
"http://localhost:8181/api/v3/enterprise/configure/token" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer AUTH_TOKEN" \
  --data '{
    "token_name": "Read-write for DATABASE1, DATABASE2",
    "permissions": [{
      "resource_type": "db",
      "resource_names": ["DATABASE1","DATABASE2"],
      "actions": ["read","write"]
     }],
     "expiry_secs": 300000
  }'
```

### [List resource tokens](/influxdb3/enterprise/admin/tokens/resource/list/)

Use the `influxdb3` CLI or the HTTP API to list resource tokens with fine-grained access permissions in your InfluxDB 3 Enterprise instance. Use the `influxdb3 show tokens` command to list all tokens or use SQL to query token metadata directly from the `system.tokens` table.

##### CLI

```bash
influxdb3 show tokens
```

##### HTTP API

```bash
curl -G \
"http://localhost:8181/api/v3/query_sql" \
--data-urlencode "db=_internal" \
--data-urlencode "q=SELECT * FROM system.tokens WHERE permissions NOT LIKE '\*%'" \
--header 'Accept: application/json' \
--header "Authorization: Bearer AUTH_TOKEN" 
```

### [Use a preconfigured permission (resource) tokens](/influxdb3/enterprise/admin/tokens/resource/preconfigured/)

Start InfluxDB 3 Enterprise with a preconfigured “offline” permission (resource) tokens file. If no tokens already exist, InfluxDB automatically creates resource tokens specified in the provided permissions (resource) tokens file.

[tokens](/influxdb3/enterprise/tags/tokens/)