API Tokens
API tokens provide specific permissions and limits when using and accessing LogScale through any of the APIs. These API tokens provide fine grained control over the capabilities, IP access and expiration of the API token. For example, an API token can be created that only allows a user to be created but that expires after an hour. In contrast a Personal API token has all the abilities and permissions of the roles applied to the user, with no expiry.
Each API token is configured and created with one or more of the following parameters:
API Token name
The name of the token used to identify the token
API Token domain
There are specific API tokens for different areas of LogScale functionality, including:
Permissions
Depending on the domain, API tokens will have one or more permissions which can be explicitly granted. These only apply to the generated API token, and limit the ability of the token to that functionality. See:
IP Filter
An IP filter can be applied to limit access to a specific IP address or network. See IP Filters more information.
Expiry
A token can be configured to automatically expire on a set date. These can be set individually or within the corresponding security policy for the API token. See API Token Security Policies for more information.
Using these combinations of parameters, examples of the API tokens that can be created include:
A token creating a new repository that can only be used by clients in the local network.
A fleet management token that expires after 1 day to be used during automated deployments
A token to update S3 storage parameters granted to an admin for AWS
The following API tokens, and their scope, are:
| Named | Permission Model | Supports Expiry | Supports IP Filter | |
|---|---|---|---|---|
| Personal API Token | No | Inherits all permissions of the user | Yes | Yes |
| Repository and view tokens | Yes | Specific repository and view permissions | Yes | Yes |
| Organization tokens | Yes | Specific organization permissions | Yes | Yes |
| System tokens | Yes | Specific system permissions | Yes | Yes |
Because API tokens provide access to the LogScale instance through the API, the following controls exist around all tokens:
Expired tokens cannot be extended or renewed
Tokens that have been created with an IP filter cannot have the filter removed
The token secret cannot be modified, but it can be 'reset', generating a new random string to be used for accessing the API.
Token creation and usage is tracked within the Audit Logging.