app-tokens create

Command: boundary app-tokens create

The app-tokens create command lets you create Boundary app token resources.

Examples

The following example creates an app token by passing in a scope and permissions. You can pass permissions directly as a JSON array or as a path to a JSON file using the file:// prefix, for example, file://perms.json.

$ boundary app-tokens create \
  -scope-id $SCOPE_ID \
  -name "Example App Token" \
  -description "An example app token in the global scope." \
  -time-to-live 30d \
  -time-to-stale 1d \
  -permissions '[{"grants":["id=*;type=target;actions=list,read"],"grant_scopes":["this"]}]'

Example output:

App Token information:
  Approximate Last Access Time:   Thu, 01 Oct 2026 18:04:09 PDT
  Created By User ID:             u_1234567890
  Created Time:                   Thu, 01 Oct 2026 18:04:09 PDT
  Description:                    An example app token in the global scope.
  Expiration Time:                Sat, 31 Oct 2026 18:04:09 PDT
  ID:                             appt_1234567890
  Name:                           Example App Token
  Status:                         active
  Token:
  appt_0123456789_abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz1234567890

  Scope:
    ID:                           global
    Name:                         global
    Type:                         global

  Permissions:
    Permission 1:
      Grants:
        id=*;type=target;actions=list,read
      Grant Scopes:
        this

  Authorized Actions:
    delete
    no-op
    read
    read:self
    revoke

Copy the app token's token value in the response. This is the only time the app token's token value is displayed. You will not have another opportunity to save it.

Usage

$ boundary app-tokens create [options] [args]

Command options

• -description (string: "") - The description to set on the app token.
• -name (string: "") - The name to set on the app token.
• -scope-id (string: "") - The scope in which to make the request. You can also specify the scope using the BOUNDARY_SCOPE_ID environment variable.
• -time-to-live (string: "") - The duration of the app token. Passed in as a duration string (uses d, h, m, s, ms, ns as options).
• -time-to-stale (string: "") - The optional duration of inactivity after which the token becomes stale. Passed in as a duration string (uses d, h, m, s, ms, ns as options).
• -permissions (string: "") - The permissions to set for the app token. Can be passed directly as a JSON array (for example '[{"grants":["id=*;type=target;actions=list,read"],"grant_scopes":["this"]}]') or as a path to a JSON file using the file:// prefix (for example file://perms.json).