Creates an access token for the JFrog Platform, or refreshes an existing access token. Only internal Artifactory users can generate a token using basic credentials via REST API.
Create Token Notes:
- You can create tokens at the project level if you are a Project Admin.
- You cannot create a token using basic credentials if you enabled multi-factor authentication.
- If you use basic credentials, you must enable creation of tokens in the JFrog Platform UI.
Refresh Token:
To refresh an existing access token, set grant_type to refresh_token and provide the refresh_token parameter. The authenticated user must match the user of the access token being refreshed (identified by the refresh token).
Security: Requires a valid token or user credentials. Basic authentication is supported when enabled in the platform configuration.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Sample Usage with token
curl -H "Authorization: Bearer <valid access token>" -XPOST "http://localhost:8082/access/api/v1/tokens" -d "scope=applied-permissions/user"200
{
"token_id": "<id>"
"access_token": "<access-token>",
"refresh_token": "<refresh-token>",
"expires_in": "<seconds>",
"scope": "applied-permissions/user",
"token_type": "access_token"
}Sample Usage with user credentials
curl -u "login:password" -XPOST "http://localhost:8082/access/api/v1/tokens" -d "scope=applied-permissions/user"200
{
"user_id": "<id>"
"password": "<password>",
"refresh_token": "<refresh-token>",
"expires_in": "<seconds>",
"scope": "applied-permissions/user",
"token_type": "access_token"
}Invalid input, e.g., expires_in value is not a number, non-positive number, etc.
Unauthenticated
The requested token details are forbidden, e.g., expires_in provided but is higher than the limit defined by the admin, the user does not have the permissions on the scope requested, etc.