--- updatedAt: 2026-07-29T14:27:29.000Z agentTools: siteIndex: https://docs.jfrog.com/llms.txt projectIndex: https://docs.jfrog.com/integrations/llms.txt --- # Create Access Tokens With JFrog CLI Create scoped or admin access tokens for JFrog Platform users with JFrog CLI. Create an access token. By default, you get a user-scoped token. Administrators can provide scope with `--scope`, or implicitly with `--groups` or `--grant-admin`. ## Prerequisites * **Access token authentication required.** Your JFrog server must be configured with an access token. Username and password authentication is not supported for this command. The JFrog CLI returns an error if you attempt to use it with a username and password-configured server. To reconfigure, run [`jf config add`](/integrations/docs/jf-config-add) and provide an access token instead of a password. ## Synopsis ```bash jf access-token-create [] [options] ``` **Aliases:** `jf atc` ## Arguments The following table describes command arguments. | Argument | Required | Description | | ------------ | -------- | ---------------------------------------------------------------------------- | | `` | No | Username for which the token is created. Omit to create for the current user | ## Options The following table describes command options. | Flag | Short | Default | Description | | ------------------------ | ----- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--url` | — | — | JFrog Platform URL | | `--user` | — | — | JFrog username | | `--password` | — | — | JFrog password | | `--access-token` | — | — | JFrog access token for authentication | | `--server-id` | — | — | Server ID from `jf config` | | `--ssh-key-path` | — | — | SSH key file path for authentication | | `--ssh-passphrase` | — | — | SSH key passphrase | | `--client-cert-path` | — | — | Client certificate file in PEM format (for mutual TLS authentication) | | `--client-cert-key-path` | — | — | Private key file for the client certificate in PEM format | | `--project` | — | — | JFrog project key | | `--grant-admin` | — | `false` | Grant admin privileges (administrators only) | | `--groups` | — | — | Comma-separated list of groups (administrators only) | | `--scope` | — | — | Token scope (administrators only) | | `--expiry` | — | platform default | Token expiry in seconds. Use `0` for a non-expiring token (admin only). Non-admin users cannot exceed the platform default (1 year by default). | | `--refreshable` | — | `false` | Create a refreshable token | | `--description` | — | — | Free-text token description (max 1024 characters) | | `--audience` | — | — | Space-separated list of Service-IDs that accept this token | | `--reference` | — | `false` | Generate a Reference Token **in addition to** the full access token. Both tokens are returned. Reference tokens are stored in the platform database and can be individually revoked. (JFrog Artifactory 7.38.10+) | | `--format` | — | `json` | Output format. Available from JFrog CLI 2.105.0. Accepts `json` or `table`. Defaults to `json` for backward compatibility. In table output the `access_token` value is truncated to 40 characters. Passing `--format` with no value returns `Incorrect Usage: flag needs an argument: -format`. Passing an unsupported value (for example, `--format=yaml`) returns `[Error] only the following output formats are supported: json, table`. | ## Examples This section includes the following examples: * [Create a Token for the Current User](#create-a-token-for-the-current-user) * [Create a Token for a Specific User](#create-a-token-for-a-specific-user) * [Create a Refreshable Token](#create-a-refreshable-token) ### Create a Token for the Current User Create an access token scoped to your own account. **To create an access token for the current user:** 1. Ensure a JFrog server is configured, or plan to pass `--url` and `--access-token`. See [Authenticate via the JFrog CLI](/integrations/docs/authenticating-via-the-cli) for setup options. 2. Run: ```bash jf access-token-create ``` Or using the alias: ```bash jf atc ``` The command creates a token for the authenticated user. You must have a configured server or pass `--url` and `--access-token`. On success, the JFrog CLI prints the response in the format set by `--format`. The `access_token` field contains the token value. Copy it immediately, as it is displayed only once. `--format json` (default): ```json { "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...", "token_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "expires_in": 3600, "scope": "applied-permissions/user", "token_type": "Bearer", "refreshable": false, "refresh_token": "", "reference_token": "", "grant_type": "client_credentials", "audience": "jfrt@*" } ``` `--format table` (the `access_token` is truncated to 40 characters to avoid flooding the terminal): ``` FIELD VALUE access_token eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9... token_id a1b2c3d4-e5f6-7890-abcd-ef1234567890 expires_in 3600 scope applied-permissions/user token_type Bearer refreshable false grant_type client_credentials audience jfrt@* ``` ### Create a Token for a Specific User Administrators can create an access token for another user by specifying their username. **To create an access token for another user as an administrator:** 1. Run one of the following: ```bash jf access-token-create --server-id= ``` Where: * ``: Target JFrog username for the new token. * ``: Server ID from your `jf config` configuration. For example: ```bash jf access-token-create jdoe --server-id=my-server ``` 2. Alternatively, pass credentials inline: ```bash jf access-token-create --url= --access-token= ``` Where: * ``: Target JFrog username for the new token. * ``: Base URL of your JFrog Platform deployment. * ``: Valid access token for an administrator. Use a real token and do not commit it. For example: ```bash jf access-token-create jdoe --url=https://acme.jfrog.io --access-token= ``` Administrators create tokens for other users by specifying the username and credentials. ### Create a Refreshable Token Create a refreshable access token that returns a refresh token for renewing access without re-authenticating. **To create a refreshable access token:** * Run: ```bash jf access-token-create --refreshable --expiry= ``` Where: * ``: Token lifetime in seconds before expiry (for example, `3600`). For example: ```bash jf atc --refreshable --expiry=3600 ``` The token is refreshable, and a refresh token is returned for renewing it when it expires. On success: ```json { "access_token": "eyJ...", "refresh_token": "eyJ...", "expires_in": 3600, "scope": "applied-permissions/user", "token_type": "Bearer" } ``` Use the `refresh_token` value to obtain a new access token before the original expires. ## Important Notes * **Default scope.** Without `--scope`, `--groups`, or `--grant-admin`, the token has the same permissions as the creating user. * **Expiry.** If you don't set `--expiry`, the platform's default token expiry applies (typically 1 year). Non-admin users cannot set an expiry greater than the platform default. Use `--expiry=0` for a never-expiring token. This requires admin privileges. * **Reference tokens.** Use `--reference` to create a reference token alongside the full access token. Both are returned in the response. Reference tokens are stored in the platform database and can be revoked individually. (JFrog Artifactory 7.38.10+) * **Refreshable tokens.** Use `--refreshable` to get a refresh token alongside the access token. This helps long-running CI/CD pipelines that may outlive the token's expiry. * **Admin-only flags.** `--grant-admin`, `--groups`, and `--scope` require admin privileges. Non-admin users can only create tokens for themselves. * **Security.** Tokens are displayed only once at creation time. Store them securely. If lost, create a new token. ## Frequently Asked Questions This section provides answers to frequently asked questions. ##### Q: How do I create an access token for myself with JFrog CLI? **A:** Run `jf access-token-create` (or the alias `jf atc`) with a configured server. See [Create a Token for the Current User](#create-a-token-for-the-current-user) for the full command. ##### Q: What happens if I run `jf access-token-create` against a server configured with a username and password? **A:** The command fails because access token authentication is required. Reconfigure the server with [`jf config add`](/integrations/docs/jf-config-add) and provide an access token instead. ##### Q: What is the difference between a refreshable token and a reference token? **A:** A refreshable token (`--refreshable`) returns a refresh token you can use to renew access before it expires. A reference token (`--reference`) is a separate, individually revocable token returned alongside the full access token. See [Important Notes](#important-notes) for details. ##### Q: What permissions do I need to create an access token for another user? **A:** You need administrator privileges. Non-admin users can only create tokens for themselves, and admin-only flags like `--grant-admin`, `--groups`, and `--scope` require admin privileges. ##### Q: Can I set a custom expiry for an access token? **A:** Yes. Pass `--expiry=`. Non-admin users can't exceed the platform default, but admins can pass `--expiry=0` for a token that never expires. ## Related Topics * [Add a JFrog CLI Server Configuration](/integrations/docs/jf-config-add) * [Show JFrog CLI Server Configurations](/integrations/docs/jf-config-show) * [Authenticate via the JFrog CLI](/integrations/docs/authenticating-via-the-cli) * [Exchange an OIDC Token for JFrog Access](/integrations/docs/jf-exchange-oidc-token) * [JFrog CLI Command Reference](/integrations/docs/jfrog-cli-command-reference)