Access Tokens

From GoCD server version 19.2.0 onwards, you will be able to create personal access tokens to access GoCD API(s). This will allow users to make an API call without specifying their credentials (username & password) as a part of API request headers.

Usage instructions

1. A token can be used to access GoCD APIs and cctray.xml by passing it in API header.

   Before 19.2.0

   curl 'https://ci.example.com/go/api/pipelines/pipeline1/status' \
          -u 'username:password'
   

   Going forward

   curl 'https://ci.example.com/go/api/pipelines/pipeline1/status' \
          -H 'Authorization: Bearer 6A7B48094CC552B9A2DF0AFADAF50D28F0646070'
   

2. A token can not be used to create or access any access token related API(s).

3. Login using access token is not allowed through web UI.

4. Once a token is revoked, the user will not be able to activate it again.

5. All tokens belonging to a user will be revoked automatically as soon as the user is deleted from GoCD.

   • Note: These tokens will not be visible again even if the same user is added back to GoCD.

Create a token

1. Login into your GoCD server.

2. Go to user menu → Personal Access Tokens.

3. Click on Generate Token button.

4. Add a description for the token. This is to identify what is this token for?

5. Click on Generate button.

6. On success, you will see the newly generated token.

   Make sure you copy the token before you close the dialog. It will not be shown again.

   

Revoke a personal token

1. Login into your GoCD server.

2. Go to user menu → Personal Access Tokens.

3. Find the token which you wish to revoke in ACTIVE TOKENS tab.

4. Click on the Revoke button.

5. Optionally, add a reason for revoking the token.

6. Click on Revoke Token button.

7. On success, the token just revoked will be shown in REVOKED TOKENS tab.

Manage access tokens (admin only)

1. Login into your GoCD server.

2. Go to Admin menu → Security → Access Tokens Management.

3. The admin will be able to see all the tokens created by all the users

   • Active tokens

   • Revoked tokens

4. The admin can use the search box on the top-right to search tokens on the basis of Created By and Description.

Revoke token

1. Login into your GoCD server.

2. Go to Admin menu → Security → Access Tokens Management.

3. Find the token which you wish to revoke in ACTIVE TOKENS tab.

4. Click on the Revoke button.

5. Optionally, add a reason for revoking the token.

6. Click on Revoke Token button.

7. On success, the token just revoked will be shown in REVOKED TOKENS tab.