Skip to content
LogScale Self-Hosted
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## Tokens in LogScale

LogScale supports a variety of different tokens that are used to provide API access to the different components of the system. Tokens use a randomly generated sequence of characters that identify the authority of a system or service to use a particular aspect of the LogScale instance.

Performing different actions, particularly through the API, is controlled through the API token and it is a combination of the type of API token, and the individual permissions granted to it, that allow or restrict access.

> For example, to perform Organization level administration an Organization API token must be used. Having an Ingest Token or Repository API Token does not grant privileges to manage the organization. Conversely, data cannot be read or accessed using an Organization API Token, as these are only for managing your LogScale installation.

The basic model for the API Tokens and security architecture is shown in Figure 35, “API Token Architecture in LogScale”.

%%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% graph LR; PT[Personal Token] subgraph Management Tokens RT[Repo Token] ST[System Token] OT[Organization Token] end subgraph Permissions SP[System Permission] OP[Organization Permission] RP[Repo Permissions] end subgraph Resource RR[Repository] RO[Organization] RC[Cluster] end subgraph Roles RlR[Repository] RlO[Organization] RlC[Cluster] end PT-->Roles SP<-->RlC RP<-->RlR OP<-->RlO RR<-->RP RO<-->OP RC<-->SP RT-->RR ST-->RC OT-->RO
Diagram illustrating the API Token Architecture in LogScale, showing the relationships between different token types, permissions, resources, and roles. The flowchart depicts how Personal Tokens connect to Roles, while Management Tokens (Repository Tokens, System Tokens, and Organization Tokens) connect to their respective Resources (Repository, Cluster, and Organization). The diagram shows how Permissions (Repository, Organization, and System Permissions) act as intermediaries between Resources and Roles, creating a comprehensive security framework where each token type has specific access limitations and capabilities within the LogScale environment. This architecture ensures proper separation of concerns where different token types are required for different operations like data ingestion, querying, and system administration.

Figure 35. API Token Architecture in LogScale

For more detailed information about each of the API token types, see API Tokens.

API tokens are governed by Security Policies.

### Note

Ingest tokens are another type of token in LogScale, but they are not API tokens.

Ingest tokens are long-living token strings that you can use to set up your ingestion pipeline in Falcon LogScale Collector or other log shippers. Ingest tokens are used to identify the repository, parser, and authority to send data for ingestion into LogScale. They do not allow access to the API or to query data stored in repositories.

For more information, see Ingest Tokens.

#### Enter search term