1"use strict";(self.webpackChunkdatabase_lab_docs=self.webpackChunkdatabase_lab_docs||[]).push([["31098"],{7235(e,n,t){t.r(n),t.d(n,{metadata:()=>s,default:()=>h,frontMatter:()=>i,contentTitle:()=>r,toc:()=>c,assets:()=>l});var s=JSON.parse('{"id":"dblab-howtos/platform/tokens","title":"Create and use DBLab Platform access tokens","description":"Create, use, and revoke personal and administrative access tokens for DBLab Engine and the DBLab Platform, and enable personal token support.","source":"@site/docs/dblab-howtos/platform/tokens.md","sourceDirName":"dblab-howtos/platform","slug":"/dblab-howtos/platform/tokens","permalink":"/docs/dblab-howtos/platform/tokens","draft":false,"unlisted":false,"editUrl":"https://gitlab.com/postgres-ai/docs/-/edit/master/docs/dblab-howtos/platform/tokens.md","tags":[],"version":"current","frontMatter":{"title":"Create and use DBLab Platform access tokens","sidebar_label":"Create and use tokens","description":"Create, use, and revoke personal and administrative access tokens for DBLab Engine and the DBLab Platform, and enable personal token support."},"sidebar":"baseSidebar","previous":{"title":"Start using Platform","permalink":"/docs/dblab-howtos/platform/start-using-platform"},"next":{"title":"Platform onboarding checklist","permalink":"/docs/dblab-howtos/platform/onboarding"}}'),o=t(74848),a=t(28453);let i={title:"Create and use DBLab Platform access tokens",sidebar_label:"Create and use tokens",description:"Create, use, and revoke personal and administrative access tokens for DBLab Engine and the DBLab Platform, and enable personal token support."},r,l={},c=[{value:"Token types",id:"token-types",level:2},{value:"Engine tokens",id:"engine-tokens",level:3},{value:"Access tokens",id:"access-tokens",level:3},{value:"Create a token",id:"create-a-token",level:2},{value:"Enable personal tokens support",id:"enable-personal-tokens-support",level:2}];function d(e){let n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,a.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsxs)(n.p,{children:["By default, DBLab Engine uses a single ",(0,o.jsx)(n.a,{href:"/docs/reference-guides/database-lab-engine-configuration-reference#section-global-global-parameters",children:"verification token"})," for authorization of requests to its API. For security and more granular control, we recommend enabling access tokens support in the DBLab Engine configuration. In this case, all Database Lab users have personal tokens that can be revoked individually without affecting others."]}),"\n",(0,o.jsx)(n.h2,{id:"token-types",children:"Token types"}),"\n",(0,o.jsx)(n.h3,{id:"engine-tokens",children:"Engine tokens"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Verification tokens"})," - used for basic authorization of requests to DBLab Engine API. Can be used for initial setup, but using them in daily practice is not recommended"]}),"\n"]}),"\n",(0,o.jsx)(n.h3,{id:"access-tokens",children:"Access tokens"}),"\n",(0,o.jsxs)(n.p,{children:["Access tokens can be used to interact both with DBLab Engine and DBLab Platform. To work with the Database Lab CLI/API, generate a new token and use it in the ",(0,o.jsx)(n.code,{children:"Verification-Token"})," header of each individual API request. Alternatively, you can use it with the ",(0,o.jsx)(n.code,{children:"--token"})," flag during CLI initialization; in this case, ",(0,o.jsx)(n.code,{children:"Verification-Token"})," is not needed."]}),"\n",(0,o.jsxs)(n.p,{children:["Access tokens allow calling the following functions on the Platform: ",(0,o.jsx)(n.code,{children:"checkup_report_create"}),", ",(0,o.jsx)(n.code,{children:"checkup_report_file_post"}),", ",(0,o.jsx)(n.code,{children:"dblab_token_check"}),", ",(0,o.jsx)(n.code,{children:"joe_message_artifact_post"}),", ",(0,o.jsx)(n.code,{children:"joe_message_post"}),", ",(0,o.jsx)(n.code,{children:"joe_session_command_post"}),", ",(0,o.jsx)(n.code,{children:"joe_session_create"}),"."]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Administrative tokens"}
1)," - used to organize infrastructure"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Personal tokens"})," - used by individuals to work with API and CLI"]}),"\n"]}),"\n",(0,o.jsx)(n.admonition,{title:"Token context",type:"tip",children:(0,o.jsx)(n.p,{children:"Tokens of both types work in the context of a particular organization. Administrators can manage personal tokens, as well as administrative (impersonal) ones. Users can manage only their own personal tokens."})}),"\n",(0,o.jsx)(n.h2,{id:"create-a-token",children:"Create a token"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["On the ",(0,o.jsx)(n.strong,{children:"Access tokens"})," page, in the ",(0,o.jsx)(n.strong,{children:"Add token"})," section:","\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:"specify the token name (any string)"}),"\n",(0,o.jsx)(n.li,{children:"set the expiration date (1 year by default)"}),"\n",(0,o.jsxs)(n.li,{children:["choose access token type using the ",(0,o.jsx)(n.strong,{children:"Personal token"})," checkbox (only for administrators, uncheck to create ",(0,o.jsx)(n.strong,{children:"Administrative"})," token)"]}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["Click the ",(0,o.jsx)(n.strong,{children:"Add token"})," button\n",(0,o.jsx)(n.img,{alt:"Access tokens page / Add token",src:t(65412).A+"",width:"1924",height:"1188"})]}),"\n",(0,o.jsxs)(n.li,{children:["Save the token, it will not be shown again. You can use the ",(0,o.jsx)(n.strong,{children:"Copy"})," button\n",(0,o.jsx)(n.img,{alt:"Access tokens page / Copy token",src:t(2271).A+"",width:"1924",height:"1188"})]}),"\n"]}),"\n",(0,o.jsx)(n.h2,{id:"enable-personal-tokens-support",children:"Enable personal tokens support"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["Follow ",(0,o.jsx)(n.a,{href:"#create-a-token",children:(0,o.jsx)(n.strong,{children:"Create a token"})})," guide to create an administrative access token for the DBLab Engine to connect to the Platform."]}),"\n",(0,o.jsxs)(n.li,{children:["Add the ",(0,o.jsx)(n.code,{children:"platform"})," section to the DBLab Engine configuration. For example:","\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:'platform:\n # Platform API URL. To work with Postgres.ai SaaS, keep it default\n # ("https://postgres.ai/api/general").\n url: "https://postgres.ai/api/general"\n\n # Token for authorization in Platform API. This token can be obtained on\n # the Postgres.ai Console: https://postgres.ai/console/YOUR_ORG_NAME/tokens\n # This token needs to be kept in secret, known only to the administrator.\n accessToken: "platform_access_token"\n\n # Enable authorization with personal tokens of the organization\'s members.\n # If false: all users must use "accessToken" value for any API request\n # If true: "accessToken" is known only to admin, users use their tokens,\n # and any token can be revoked not affecting others.\n enablePersonalTokens: true\n'})}),"\n"]}),"\n"]})]})}function h(e={}){let{wrapper:n}={...(0,a.R)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},65412(e,n,t){t.d(n,{A:()=>s});let s=t.p+"assets/images/tokens-1-899470189cb6a16de38279637cd07ace.png"},2271(e,n,t){t.d(n,{A:()=>s});let s=t.p+"assets/images/tokens-2-5c123ccbbaaeec462d283929eb431a89.png"},28453(e,n,t){t.d(n,{R:()=>i,x:()=>r});var s=t(96540);let o={},a=s.createContext(o);function i(e){let n=s.useContext(a);return s.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.