app-tokens

Command: boundary app-tokens

The app-tokens command lets you manage the app token resource in Boundary. You can use app tokens for machine-to-machine authentication.

Examples

The following example creates an app token by passing in a scope and permissions. You can pass permissions directly as a JSON array or as a path to a JSON file using the file:// prefix, for example, file://perms.json.

$ boundary app-tokens create \
  -scope-id $SCOPE_ID \
  -name "Example App Token" \
  -description "An example app token in the global scope." \
  -time-to-live 30d \
  -permissions '[{"grants":["id=*;type=target;actions=list,read"],"grant_scopes":["this"]}]'

Example output:

App Token information:
  Approximate Last Access Time:   Thu, 01 Oct 2026 18:04:09 PDT
  Created By User ID:             u_1234567890
  Created Time:                   Thu, 01 Oct 2026 18:04:09 PDT
  Description:                    An example app token in the global scope.
  Expiration Time:                Sat, 31 Oct 2026 18:04:09 PDT
  ID:                             appt_1234567890
  Name:                           Example App Token
  Status:                         active
  Token:
  appt_0123456789_abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890

  Scope:
    ID:                           global
    Name:                         global
    Type:                         global

  Permissions:
    Permission 1:
      Grants:
        id=*;type=target;actions=list,read
      Grant Scopes:
        this

  Authorized Actions:
    delete
    no-op
    read
    read:self
    revoke

Usage

Usage: boundary app-tokens [sub command] [options] [args]

  # ...

Subcommands:
    create          Create an app token
    list            List app tokens
    read            Read an app token
    revoke          Revoke an app token
    delete          Delete an app token

For more information, examples, and usage, click on the name of the subcommand in the sidebar or one of the links below: