Security
Access tokens
Scoped access tokens for the relic CLI, CI and the Relic API.
A token acts with your own permissions, a group's permissions (without those given to you by name or project role), or as admin.
- Set me up in the UI creates tokens that act with your own permissions. Tokens for a
group, as admin or for another user come from
relic auth token create(--group,--scope admin,--user). Administration → Access tokens lists every user's tokens; administrators revoke them there. - A token's project (
relic auth token create --project) is only a label; it must name a project you can see. - A scoped token cannot create a wider token or approve a CLI sign-in.
- Signing in to the UI with a token as password gives a session with its scope.
- A token, or a UI session, made with a token expires no later than that token. Revoking
the token (
relic auth token revoke, or Access tokens in the UI) also revokes them, and what was made with them in turn. Signing out with a token revokes only that token. - A UI session made with a token cannot approve a CLI sign-in.
- Revoking a token takes effect at once on every replica.
Lifetimes
| Token | Lifetime |
|---|---|
relic auth token create, or Set me up in the UI | As chosen: at most 365 days for non-administrators, even when asked never to expire; for administrators up to 3650 days, or none. Made with a token, as the CLI does with its context's, no longer than that token. |
Saved by relic auth login | 90 days by default (--expires-days), same limits. Revoked by relic auth logout or a new sign-in to the context. |
Given by relic package setup | 90 days by default (--expires-days), same limits, and no longer than the context's token. |
| UI session | 12 hours. |
| CLI sign-in approved in the browser | One hour, refreshable. relic auth login exchanges it at once; jf login (the JFrog® CLI) keeps and refreshes it. |
| Workload identity | An hour at most. |
jf access-token-create --reference returns the token itself, which works wherever a
reference token does.
Changing a user's password, or removing them from LDAP or the identity provider, does not end their tokens or sessions. Disabling the user suspends them until re-enabled; deleting the user revokes them.