Appearance
Personal Access Tokens Beta
A PAT (personal access token) is a credential for operating Codatum from the Codatum CLI. For how each user issues and edits their own tokens, see the account's Personal Access Tokens page.
From global nav > Workspace settings > Personal Access Tokens, you can list and manage PATs issued within the workspace. You also issue PATs for service accounts on this page.
INFO
This feature is in beta. The specification might change without notice.
Prerequisites
- The menu is shown and usable only if the workspace policy doesn't disable Codatum CLI use.
- Guests can't use PATs.
- Workspace Owners and users whose custom role has Edit selected for Workspace settings in Roles can view the list and Suspend / Resume / Revoke tokens (Workspace permissions).
- Only Workspace Owners can issue and edit PATs for service accounts.
Issue a service account token
You can issue a PAT for a service account for runs that aren't tied to a user, such as CI. Operations performed with a service account's PAT use the service account's permissions, not the permissions of the user who issued it.
- Click Issue service account token.
- Enter the following fields, and click Issue.
| Field | Description |
|---|---|
| Service account | The service account to issue the token for |
| Name | An identifying name for the token |
| Expiration | Can be set in 1-day increments, up to 365 days (Limits) (Tokens without an expiration can't be issued) |
| Restrict token permissions | By default, the token inherits all of the service account's permissions. To grant only a subset, turn this on and narrow the scope of connections / notebooks / tags. For an overview, see Permissions overview |
The plaintext token is shown only once, right after issuance, and can't be retrieved again. Copy the plaintext token, store it in a safe place, and don't share it with third parties.
The following specifications apply to service account PATs.
- IP access control doesn't apply. It applies to users' PATs.
- The token stays usable even if the user who issued it leaves the workspace.
- When you delete a service account, its PATs are also deleted and no longer appear in the list.
- You can't issue one from the browser approval of
cdm auth loginin the Codatum CLI.
List
| Column | Description |
|---|---|
| Account | The account whose permissions the token uses. For a user's PAT, the user who issued it; for a service account's PAT, the service account |
| Name (token) | The token name and a masked display with a prefix |
| Issuer | The user who issued the service account's PAT. - for a user's PAT |
| Permission restriction | Configured if a permission boundary is set; otherwise - |
| Last used | The last-used time (Unused if never used) |
| Expires | The token's expiration date |
| Status | Active / Suspended / Revoked / Expired |
By default, revoked and expired tokens are hidden. Turn on Show revoked and expired to include them in the list. You can search by token name or account, and filter by account type (All accounts / Users / Service accounts).
Operations
| Operation | Description |
|---|---|
| View permissions | Check the grants of a token that has a permission restriction configured |
| Edit | Changes the name and permission restriction of a service account's PAT. Only Workspace Owners can do this. A user's PAT is edited by the user who issued it, in account settings |
| Suspend | Temporarily blocks authentication for an active token, until resumed |
| Resume | Re-enables authentication for a suspended token |
| Revoke | Immediately invalidates the token. This can't be undone |
Operations on PATs, such as creating and revoking them, and operations performed with a PAT are recorded in the audit logs.
Relationship with account settings
| Location | What you can do |
|---|---|
| Personal Access Tokens in account settings | Create, update, suspend, and revoke tokens you issue yourself |
| Personal Access Tokens in workspace settings (this page) | List tokens issued within the workspace, and Suspend / Resume / Revoke / View permissions. Issue and edit service account tokens |
A permission boundary is a mechanism that caps the token at the permissions of the token's account (a user or a service account), then further narrows it to a scope of connections / notebooks / tags. For an overview, see Permissions overview.