Access tokens authenticate Alibaba Cloud DevOps API calls and git operations over HTTP. This topic covers token security guidelines and how to create an access token.
Token authorization
-
When you create a token, select the required API permissions and set a validity period. Grant only the permissions necessary for the intended use and choose the shortest validity period that meets your needs.
-
A token has the same resource access and operation capabilities as the user who created it, limited by the API permission scope granted to the token. A token cannot grant permissions beyond what the user already has.
Secure storage
Treat tokens with the same level of security as passwords:
-
Do not share tokens through unencrypted emails, instant messages, or other insecure channels.
-
Do not pass tokens in plain text on command lines.
-
Do not commit unencrypted tokens to public repositories or other insecure environments.
Prudent usage
-
Do not hard-code tokens in your source code. Instead, store tokens in environment variables and read them at runtime. This prevents token exposure from unauthorized code access and reduces the risk of data breaches.
-
Avoid using permanent tokens. Rotate tokens periodically and revoke them immediately if security risks are detected.
-
If a token is compromised, delete it immediately.
Procedure
Alibaba Cloud DevOps displays a token only once upon creation. The token cannot be retrieved afterward. All tokens are encrypted and securely stored.
When requesting and using tokens, follow these security principles to reduce risk: principle of least privilege, secure storage, and prudent usage.
-
Log on to the Alibaba Cloud DevOps workbench. For more information, see Account and logon.
-
On the Workbench page, click the profile picture in the upper-right corner, and then click Personal Settings from the dropdown menu.
-
In the left-side navigation pane of the Personal Settings page, click Access Token. On the Access Token page, click Create Access Token and configure the following settings.
Parameter
Description
Token Name
A custom name for the token. The name can be up to 64 characters in length.
Description (optional)
An optional description of the token.
Expiration Date
The expiration date of the token.
WarningAfter a token expires, you cannot use it to call API operations.
Select Permissions
The API permissions granted to the token. Follow the principle of least privilege when selecting permissions.
-
Click Create.
-
Save the generated token immediately after creation. It will be displayed only once and cannot be retrieved later.