HashiConf 2025 Don't miss the live stream of HashiConf Day 2 happening now View live stream
Boundary Home

App tokens

An app token is a resource that provides a mechanism for machine-to-machine authentication to Boundary. An app token's access is managed by permissions, which include grants and grant scopes. You can create app tokens in the global, organization, or project scopes. An app token persists even if the user who creates it is deleted from the system.

You cannot update an app token once created. You can read, list, revoke, and delete app tokens.

Attributes

An app token has the following attributes:

  • id - (output only) The ID of the app token.

  • scope_id - The ID of the scope in which the app token was created.

  • scope - (output only) Information about the scope in which the app token was created.

  • token - (output only) The app token value. This value is only ever visible when you create the app token.

  • name - (optional) If set, the name must be unique within the app token's scope.

  • description - (optional)

  • created_by_user_id - (output only) The ID of the user who created the app token.

  • created_time - (output only) The time the app token was created in Boundary.

  • approximate_last_access_time - (output only) The approximate time the app token was last used.

  • time_to_stale_seconds - (optional) The maximum period of inactivity after which the app token is considered stale and can no longer be used for authentication.

  • expiration_time - (output only) The time the app token expires.

  • status - (output only) The current status of the app token. Can be one of active, stale, revoked, or expired.

  • permissions - The permissions granted to this app token.

  • authorized_actions - (output only) The actions available to the authenticated token.

Expiration

App tokens can expire based on two parameters:

  • time_to_live_seconds sets the maximum lifetime of the app token. This parameter is used at creation to calculate the expiration_time attribute. The maximum value for this parameter is 3 years.

  • time_to_stale_seconds is an optional parameter that sets the maximum period of inactivity of the app token.

You set these parameters on an app token when you create it.

Permissions

When you create an app token, you provide a permissions value that defines the grants and grant scopes the token has. Permissions follow the same grant string format used for roles. You can pass permissions directly as a JSON array or as a path to a JSON file using the file:// prefix, for example, file://perms.json.

App token grants are intentionally limited in scope. You cannot assign the following grants to an app token:

  • Write actions (create, revoke, and delete) on the app token resource.

  • authorize-session action on the target resource.

To better understand Boundary's permissions model, refer to Permissions in Boundary.

Service API docs

The following services are relevant to this resource:

Edit this page on GitHub