ALTER SERVICE ACCOUNT CREATE TOKEN reference

Enterprise:

RBAC provides fine-grained database permissions management.

Learn moreFree trial

ALTER SERVICE ACCOUNT ... CREATE TOKEN adds a JSON Web Key or a REST API token to a service account.

---

Syntax

ALTER SERVICE ACCOUNT serviceAccountName CREATE TOKEN TYPE
    { JWK | REST WITH TTL timeUnit [REFRESH] };

Description

• ALTER SERVICE ACCOUNT serviceAccountName CREATE TOKEN TYPE JWK adds a JSON Web Key to the service account. It returns the public key (x, y) and the private key. The private key is not stored in QuestDB, so capture it when it is returned.
• ALTER SERVICE ACCOUNT serviceAccountName CREATE TOKEN TYPE REST WITH TTL timeUnit [REFRESH] adds a REST API token to the service account.

TTL and REFRESH

The TTL value is an integer and a unit, such as 1m. The supported units are:

• s for second
• m for minute
• h for hour
• d for day

The minimum allowable TTL value is 1 minute and the maximum is 10 years (10 * 365 days).

REFRESH is optional. When specified, the token's expiration timestamp is refreshed on each successful authentication.

REST API tokens and database replication

Many QuestDB Enterprise instances run within active database replication clusters. With replication enabled, the REST API token is refreshed on successful authentication to the primary node. The token is not refreshed during successful authentications to replica nodes.

Therefore, tokens with the REFRESH modifier are for use only on the primary node.

Examples

Add a JSON Web Key

ALTER SERVICE ACCOUNT client_app CREATE TOKEN TYPE JWK;

Add a REST API token

-- generate a token with no TTL refresh
ALTER SERVICE ACCOUNT client_app CREATE TOKEN TYPE REST WITH TTL '1m';
-- generate a token with TTL refresh
ALTER SERVICE ACCOUNT client_app CREATE TOKEN TYPE REST WITH TTL '1m' REFRESH;

Verify with:

SHOW SERVICE ACCOUNT client_app;

auth_type	enabled
Password	false
JWK Token	true
REST Token	false

See also

• DROP TOKEN