influxdb3 create token --permission

The influxdb3 create token command with the --permission option creates a new authentication token with fine-grained access permissions for specific resources in InfluxDB 3 Enterprise.

Fine-grained access permissions allow you to specify the exact actions, such as read and write that a token can perform on a specific resource, such as a database or a system information endpoint.

Usage

influxdb3 create token --permission <PERMISSION> --name <NAME> [OPTIONS]

Options

Permission format

The --permission option takes a value in the format RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS.

• RESOURCE_TYPE: Available resource types include:
  • db for databases
  • system for system information endpoints.
• RESOURCE_NAMES: Can be a specific resource name, such as a database name, a comma-separated list of names, or * to grant access to all resources of the type.
• ACTIONS: A list of actions. Available actions depend on the resource type.

Examples

• Create a token with read and write access to a database
• Create a token with read-only access to a database
• Create a token with access to multiple databases
• Create a token with access to all databases
• Create a token that expires in seven days
• Create a system token for health information
• Create a token with access to all system information
• Create a token with multiple permissions
• Generate an offline permission (resource) tokens file

Create a token with read and write access to a database

influxdb3 create token \
  --permission "db:my_database:read,write" \
  --name "Read/write token for my_database"

Create a token with read-only access to a database

influxdb3 create token \
  --permission "db:my_database:read" \
  --name "Read-only token for my_database"

Create a token with access to multiple databases

influxdb3 create token \
  --permission "db:database1,database2:read,write" \
  --name "Multi-database token"

Create a token with access to all databases

influxdb3 create token \
  --permission "db:*:read,write" \
  --name "All databases token"

Create a token that expires in seven days

influxdb3 create token \
  --permission "db:my_database:read,write" \
  --name "Expiring token" \
  --expiry 7d

Create a system token for health information

influxdb3 create token \
  --permission "system:health:read" \
  --name "System health token"

Create a token with access to all system information

influxdb3 create token \
  --permission "system:*:read" \
  --name "All system information"

Create a token with multiple permissions

influxdb3 create token \
  --permission "db:database1:read,write" \
  --permission "system:health:read" \
  --name "Multi-permission token"

Generate an offline permission (resource) tokens file

Generate an offline permission (resource) tokens file to use if no resource tokens exist when the server starts. Once started, you can interact with the server using the provided tokens. Offline permission tokens are designed to help with automated deployments.

Include the following options:

• --name (Required)
• --permissions (Required)
• --offline (Required)
• --output-file (Required)
• --create-databases (Optional)
• --expiry (Optional)

influxdb3 create token \
  --name 
TOKEN_NAME
 \
  --permission "
TOKEN_PERMISSIONS
" \
  --expiry 
DURATION
 \
  --offline \
  --create-databases 
DATABASE_LIST
 \
  --output-file 
path/to/tokens.json

Replace the following:

• TOKEN_NAME: Name for your offline permission token
• TOKEN_PERMISSIONS: Token permissions.
• DURATION: Duration for the token to remain valid, in humantime format (for example, 10d for 10 days or 1y for 1 year).
• DATABASE_LIST: Comma-separated list of database names to create when starting the InfluxDB 3 Enterprise server using the generated tokens file
• path/to/tokens.json: File path to use for the generated tokens file

{
  "create_databases": [
    "db1",
    "db2",
    "db3"
  ],
  "tokens": [
    {
      "token": "apiv3_0XXXX-xxxXxXxxxXX_OxxxX...",
      "name": "example-token",
      "expiry_millis": 1756400061529,
      "permissions": [
        "db:db1,db2:read,write",
        "db:db3:read"
      ]
    }
  ]
}