Skip to main content

​
ankra tokens

Commands to list, create, rotate, revoke, and delete API tokens. By default they act on your personal tokens. --service on list, create and rotate acts on the organisation’s service tokens instead: tokens that belong to a service account rather than a person, for pipelines and other automation. Listing and creating them needs the members.manage permission.

​
ankra tokens create

Create a personal API token named <name>. With --service, <name> is a service account of the organisation instead, and the token belongs to that account rather than to you: it keeps working when you leave the organisation, and acts with the account’s role, not yours. The account is created with --role when the organisation has none of that name; for an existing account --role must be the role it already holds. --label names the token itself (default: a timestamp). The role may not carry permissions you lack, and creating one needs members.manage. The token value is shown once.
Examples
Flags

​
ankra tokens delete

Delete an API token. The token must be revoked first.

​
ankra tokens list

List your API tokens with when each one expires. A live token that expires within 7 days reads “Expiring” in the Status column and an expired one “Expired”; the Expires column shows the date and how many days are left. Renew an expiring token before it stops working with “ankra tokens rotate <id>”. --service lists the organisation’s service tokens instead, with the service account each belongs to and the role it holds; renew one with “ankra tokens rotate <id> --service”. It needs members.manage (exit 7 without it).
Examples
Flags

​
ankra tokens revoke

Revoke an API token (can be deleted after)

​
ankra tokens rotate

Issue a new token to replace one that is about to expire, with the same name and scopes. The old token keeps working for an overlap window so you can update every place it is used, then it stops by itself. The new token value is shown once. When stdout is not a terminal the command prints only the value on stdout, so this works in scripts:
All other text goes to stderr. With -o json the whole response is printed. Use --service to rotate an organisation service token instead of a personal one. --overlap-hours sets how long the old token keeps working, from 0 (stops at once) to 168; the platform default is 24 hours.
Examples
Flags