Obtain an access token
A personal access token lets you call Alibaba Cloud DevOps API operations and perform git operations over HTTP. This topic describes the security guidelines for personal access tokens and how to obtain one.
Token authorization
-
When you create a token, you must select the API permissions that the token can access and set its validity period. Follow the principle of least privilege when you select permissions, keep the validity period within the period you actually need, and do not make the token permanent.
-
A token can access the same resources and perform the same operations as the user who requested it, further limited by the API permission scope granted to the token. A token cannot grant a user any additional permissions.
Secure storage
Handle authentication credentials the same way you handle passwords and other sensitive credentials:
-
Do not share tokens over unencrypted messages, email, instant messaging, or similar systems.
-
Do not pass tokens in plaintext on the command line.
-
Do not push unencrypted tokens to public code repositories or other uncontrolled systems.
Prudent usage
-
Do not hard-code a token in your source code or push it to a public repository. Instead, store the token in an environment variable and read that variable to add the token to the request body when you call an API operation. This prevents token leaks caused by unauthorized access to your code, which can in turn lead to data breaches.
-
Make it a habit to avoid permanent tokens and to rotate your tokens on a regular or ad hoc basis.
-
If you find that a token has been leaked, delete it immediately.
Procedure
To keep tokens used for API calls and Git operations secure, Alibaba Cloud DevOps returns and displays a token only when you create it. You cannot retrieve the original token in any later request. Alibaba Cloud DevOps also encrypts the tokens you create before storing them, which keeps them secure at rest.
When you request and use a token, follow the security principles of least privilege, secure storage, and prudent usage to reduce potential security risks.
-
Log on to the Alibaba Cloud DevOps workbench. For more information about how to log on, see Personal account and logon.
-
On the Workbench page, click your profile picture in the upper-right corner, and then click Personal Settings on the menu that appears.
-
On the Personal Settings page, click Access Token, click Create Access Token, and then configure the following parameters.
Parameter
Description
Token Name
A custom name for the token. The name can be up to 64 characters in length.
Description
An optional description of the personal access token.
Expiration Date
The validity period of the token.
WarningAfter a token expires, you cannot use it to call API operations.
Select Permissions
The permissions required for your scenario. Follow the principle of least privilege when you configure them.
-
Confirm that the configuration is correct, and then click Create at the bottom of the page.
-
Save the generated token. It is displayed only this once and cannot be viewed again.