Create Access Tokens With JFrog CLI

Create an access token. By default, you get a user-scoped token. Administrators can provide scope with --scope, or implicitly with --groups or --grant-admin.

Prerequisites

• Access token authentication required. Your JFrog server must be configured with an access token. Username and password authentication is not supported for this command. The JFrog CLI returns an error if you attempt to use it with a username and password-configured server. To reconfigure, run jf config add and provide an access token instead of a password.

Synopsis

jf access-token-create [<username>] [options]

Aliases: jf atc

Arguments

The following table describes command arguments.

Options

The following table describes command options.

Examples

Create a Token for the Current User

To create an access token for the current user:

1. Ensure a JFrog server is configured, or plan to pass --url and --access-token (see the prerequisite at the start of this topic).

2. Run:

   Bash

   jf access-token-create

   Or using the alias:

   Bash

   jf atc

The command creates a token for the authenticated user. You must have a configured server or pass --url and --access-token.

On success, the JFrog CLI prints the response in the format set by --format. The access_token field contains the token value. Copy it immediately, as it is displayed only once.

--format json (default):

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
  "token_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "expires_in": 3600,
  "scope": "applied-permissions/user",
  "token_type": "Bearer",
  "refreshable": false,
  "refresh_token": "",
  "reference_token": "",
  "grant_type": "client_credentials",
  "audience": "jfrt@*"
}

--format table (the access_token is truncated to 40 characters to avoid flooding the terminal):

FIELD         VALUE
access_token  eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...
token_id      a1b2c3d4-e5f6-7890-abcd-ef1234567890
expires_in    3600
scope         applied-permissions/user
token_type    Bearer
refreshable   false
grant_type    client_credentials
audience      jfrt@*

Create a Token for a Specific User

To create an access token for another user (administrators):

1. Run one of the following:

   Bash

   jf access-token-create <username> --server-id=<server-id>

   Where:

   • <username>: Target JFrog username for the new token.
   • <server-id>: Server ID from your jf config configuration.

   For example:

   Bash

   jf access-token-create jdoe --server-id=my-server

2. Alternatively, pass credentials inline:

   Bash

   jf access-token-create <username> --url=<JFrogPlatformURL> --access-token=<Token>

   Where:

   • <username>: Target JFrog username for the new token.
   • <JFrogPlatformURL>: Base URL of your JFrog Platform deployment.
   • <Token>: Valid access token for an administrator (use a real token. Do not commit it).

   For example:

   Bash

   jf access-token-create jdoe --url=https://acme.jfrog.io --access-token=<Token>

Administrators create tokens for other users by specifying the username and credentials.

Create a Refreshable Token

To create a refreshable access token:

• Run:

  Bash

  jf access-token-create --refreshable --expiry=<seconds>

  Where:

  • <seconds>: Token lifetime in seconds before expiry (for example, 3600).

  For example:

  Bash

  jf atc --refreshable --expiry=3600

The token is refreshable, and a refresh token is returned for renewing it when it expires. On success:

{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "expires_in": 3600,
  "scope": "applied-permissions/user",
  "token_type": "Bearer"
}

Use the refresh_token value to obtain a new access token before the original expires.

Important Notes

• Default scope. Without --scope, --groups, or --grant-admin, the token has the same permissions as the creating user.
• Expiry. If you don't set --expiry, the platform's default token expiry applies (typically 1 year). Non-admin users cannot set an expiry greater than the platform default. Use --expiry=0 for a never-expiring token. This requires admin privileges.
• Reference tokens. Use --reference to create a reference token alongside the full access token. Both are returned in the response. Reference tokens are stored in the platform database and can be revoked individually. (JFrog Artifactory 7.38.10+)
• Refreshable tokens. Use --refreshable to get a refresh token alongside the access token. This helps long-running CI/CD pipelines that may outlive the token's expiry.
• Admin-only flags. --grant-admin, --groups, and --scope require admin privileges. Non-admin users can only create tokens for themselves.
• Security. Tokens are displayed only once at creation time. Store them securely. If lost, create a new token.