ARTIFACTORY: Creating Access Tokens in Artifactory

In this article, we will demonstrate how to generate Access Tokens in Artifactory. For this to work, you will need Artifactory with version 7.38.4 or higher. (For more information on other versions, please refer to this section in our documentation).

There are two ways to create an access token in JFrog Artifactory:

Artifactory UI
Using an API call

Let’s begin!

Using Artifactory UI:

In order to create an Access token through the UI, follow these steps:

1. Log in to JFrog Artifactory as an administrator
2. Under "User Management," select "Access Tokens"
3. Click the "Generate Token" button

Fill out the following fields:
Token scope: Admin (token with admin permission) / User (token with permission of a specific user)
Description: brief description of the token's purpose
Expires time: date on which the token will expire
Service: Choose which product the token should have access to (Artifactory, xray, etc.)
Create Reference Token: 64-character string that can be used as a bearer token, password, or with the "X-JFrog-Art-Api" header

4. Click the "Generate" button to generate the token
5. The generated token will be displayed in the list of access tokens, including the token ID, full token, and reference token - you can refer to the image below:

This displays the Generate Token window, which includes the username, scope, audience, expiration, token ID, the full token and the Reference token.
To copy either full token or the Reference token, use the copy icon next to the token.

Notes:

Tokens generated from the UI are not stored for security reasons, so make sure to copy the token before closing the window.
Tokens generated here are not stored in the JFrog Platform for security reasons; therefore, make sure you copy the token before closing this window. Once closed the token will not be available.
It is important to store the token securely as it provides access to your JFrog Artifactory instance.

Using an API call:

To generate an Access token through a REST API call, follow these steps:

1. Create a token from the UI with the required permissions and copy the token or reference token.
2. Set the token as an environment variable. For example:

 export token="cmVmdGtuOjAxOjAwMDAwMDAwMDA6RWJzSm"

3. Use the following API call to create a token using the environment variable:

curl -H "Authorization: Bearer $token " -XPOST "http://artifactory-up:8082/access/api/v1/tokens" -d  '{"description" : "YOUR-DESCRIPTION", "token_id" : "YOUR-TOKEN-ID", "scope" : "applied-permissions/admin", "token_type" : "access_token", "include_reference_token" : "true"}' -H "Content-type: application/json"

Access token specific API calls:

To get all tokens:

curl -XGET  -H "Authorization: Bearer $token " 
"http://artifactory-ip:8082/access/api/v1/tokens"

To obtain tokens based on specific criteria, such as tokens with descriptions starting with "test":

curl -XGET  -H "Authorization: Bearer $token "
"http://artifactory-ip:8082/access/api/v1/tokens?description=test* "

Creating a token:

curl -H "Authorization: Bearer $token " -XPOST "http://artifactory-up:8082/access/api/v1/tokens" -d  '{"description" : "test", "scope" : "applied-permissions/admin", "include_reference_token" : "true", "refreshable" : "true"}' -H "Content-type: application/json"

NOTE: Refreshable tokens are not available on the UI yet. By adding the following key “refreshable” to the API call json object, you can refresh an existing access token without having to provide the old token. The Refresh Token is the same API endpoint as Create Token, with a specific grant type: refresh_token. You may find more information about the available and the required keys here.

Glossary: