--- title: influxdb3 create token --permission description: The influxdb3 create token command with the --permission option creates a new authentication token with fine-grained access permissions for specific resources in InfluxDB 3 Enterprise. url: https://docs.influxdata.com/influxdb3/enterprise/reference/cli/influxdb3/create/token/permission/ estimated_tokens: 2192 product: InfluxDB 3 Enterprise version: enterprise publisher: InfluxData canonical: https://docs.influxdata.com/influxdb3/enterprise/reference/cli/influxdb3/create/token/permission/ date: '2025-08-28T07:03:03-06:00' lastmod: '2025-08-28T07:03:03-06:00' --- The `influxdb3 create token` command with the `--permission` option creates a new authentication token with fine-grained access permissions for specific resources in InfluxDB 3 Enterprise. Fine-grained access permissions allow you to specify the exact actions, such as`read` and `write` that a token can perform on a specific resource, such as a database or a system information endpoint. ## Usage ```bash influxdb3 create token --permission --name [OPTIONS] ``` ## Options | Option | | Description | |------------------------------|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------| | |`--permission `|Permissions in `RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS` format–for example, `db:*:read,write`, `system:*:read`. `--permission` may be specified multiple times| | | `--name ` | Name of the token | | `-H` | `--host ` | The host URL of the running InfluxDB 3 Enterprise server [env: INFLUXDB3\_HOST\_URL=] [default: http://127.0.0.1:8181] | | | `--token ` | The [enterprise token](/influxdb3/enterprise/admin/tokens/admin) | |[env: INFLUXDB3\_AUTH\_TOKEN=]| | | | | `--expiry ` | The token expiration time as a duration (for example, 1h, 7d, 1y). If not set, the token does not expire until revoked | | | `--tls-ca ` | An optional arg to use a custom CA for testing with self-signed certs [env: INFLUXDB3\_TLS\_CA=] | | | `--format ` | Output format (`json` or `text` *(default)*) | | `-h` | `--help` | Print help information | | | `--help-all` | Print detailed help information | ## Permission format The `--permission` option takes a value in the format `RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS`. * `RESOURCE_TYPE`: Available resource types include: * `db` for databases * `system` for system information endpoints. * `RESOURCE_NAMES`: Can be a specific resource name, such as a database name, a comma-separated list of names, or `*` to grant access to all resources of the type. * `ACTIONS`: A list of actions. Available actions depend on the resource type. ## Examples * [Create a token with read and write access to a database](#create-a-token-with-read-and-write-access-to-a-database) * [Create a token with read-only access to a database](#create-a-token-with-read-only-access-to-a-database) * [Create a token with access to multiple databases](#create-a-token-with-access-to-multiple-databases) * [Create a token with access to all databases](#create-a-token-with-access-to-all-databases) * [Create a token that expires in seven days](#create-a-token-that-expires-in-seven-days) * [Create a system token for health information](#create-a-system-token-for-health-information) * [Create a token with access to all system information](#create-a-token-with-access-to-all-system-information) * [Create a token with multiple permissions](#create-a-token-with-multiple-permissions) * [Generate an offline permission (resource) tokens file](#generate-an-offline-permission-resource-tokens-file) ### Create a token with read and write access to a database ```bash influxdb3 create token \ --permission "db:my_database:read,write" \ --name "Read/write token for my_database" ``` ### Create a token with read-only access to a database ```bash influxdb3 create token \ --permission "db:my_database:read" \ --name "Read-only token for my_database" ``` ### Create a token with access to multiple databases ```bash influxdb3 create token \ --permission "db:database1,database2:read,write" \ --name "Multi-database token" ``` ### Create a token with access to all databases ```bash influxdb3 create token \ --permission "db:*:read,write" \ --name "All databases token" ``` ### Create a token that expires in seven days ```bash influxdb3 create token \ --permission "db:my_database:read,write" \ --name "Expiring token" \ --expiry 7d ``` ### Create a system token for health information ```bash influxdb3 create token \ --permission "system:health:read" \ --name "System health token" ``` ### Create a token with access to all system information ```bash influxdb3 create token \ --permission "system:*:read" \ --name "All system information" ``` ### Create a token with multiple permissions ```bash influxdb3 create token \ --permission "db:database1:read,write" \ --permission "system:health:read" \ --name "Multi-permission token" ``` ### Generate an offline permission (resource) tokens file Generate an offline permission (resource) tokens file to use if no resource tokens exist when the server starts. Once started, you can interact with the server using the provided tokens. Offline permission tokens are designed to help with automated deployments. Include the following options: * `--name` *(Required)* * `--permissions` *(Required)* * `--offline` *(Required)* * `--output-file` *(Required)* * `--create-databases` *(Optional)* * `--expiry` *(Optional)* ```bash influxdb3 create token \ --name TOKEN_NAME \ --permission "TOKEN_PERMISSIONS" \ --expiry DURATION \ --offline \ --create-databases DATABASE_LIST \ --output-file path/to/tokens.json ``` Replace the following: * `TOKEN_NAME`: Name for your offline permission token * `TOKEN_PERMISSIONS`:[Token permissions](#permission-format). * `DURATION`: Duration for the token to remain valid, in[humantime](https://docs.rs/humantime/latest/humantime/fn.parse_duration.html)format (for example, `10d` for 10 days or `1y` for 1 year). * `DATABASE_LIST`: Comma-separated list of database names to create when starting the InfluxDB 3 Enterprise server using the generated tokens file * `path/to/tokens.json`: File path to use for the generated tokens file [](#view-example-offline-permission-tokens-file) View example offline permission tokens file ```json { "create_databases": [ "db1", "db2", "db3" ], "tokens": [ { "token": "apiv3_0XXXX-xxxXxXxxxXX_OxxxX...", "name": "example-token", "expiry_millis": 1756400061529, "permissions": [ "db:db1,db2:read,write", "db:db3:read" ] } ] } ``` If you write a new offline permission token to an existing permission token file, the command appends the new token to the existing output file. | Option | | Description | | --- | --- | --- | | Option | | Description | | | --permission | Permissions in RESOURCE_TYPE:RESOURCE_NAMES:ACTIONS format–for example, db:*:read,write , system:*:read . --permission may be specified multiple times | | | --name | Name of the token | | -H | --host | The host URL of the running InfluxDB 3 Enterprise server [env: INFLUXDB3_HOST_URL=] [default: http://127.0.0.1:8181] | | | --token | The enterprise token | | [env: INFLUXDB3_AUTH_TOKEN=] | | | | | --expiry | The token expiration time as a duration (for example, 1h, 7d, 1y). If not set, the token does not expire until revoked | | | --tls-ca | An optional arg to use a custom CA for testing with self-signed certs [env: INFLUXDB3_TLS_CA=] | | | --format | Output format ( json or text (default) ) | | -h | --help | Print help information | | | --help-all | Print detailed help information |