Personal access tokens

Personal access tokens were introduced in Bamboo 6.10 and allow you to replace username and password in REST calls.

Personal access tokens are a secure way to use scripts and integrate external applications with Bamboo. If an external system is compromised, you simply revoke the token instead of changing password, and consequently changing it in all scripts and integrations.

You can't authenticate with personal access tokens in Bamboo UI.

Using personal access tokens

To use a personal access token for authentication, you have to pass it as a bearer token in the Authorization header of a REST API call.

Here's an example of rest using a bearer token:

curl -H "Authorization: Bearer NDc4NDkyNDg3ODE3OstHYSeYC1UgXqRacSqvUbookcZk" http://localhost:8085/bamboo/rest/api/latest/plan/PROJ-PLAN 

Managing personal access tokens

To view and manage your personal access token in Bamboo:

  • Admins cannot create tokens for users.
  • Admins can revoke tokens from Administration > Security > Users > {user_name} > Personal access tokens page.

Creating a token

  1. In the upper-right corner, click on you profile image and select Profile.
  2. Click on the Personal access tokens tab.
    Here you can view your existing tokens or create a new one.

  3. Click the Create token button.
  4. Give your token a name.
  5. Assign your token permissions.

    Learn more about tokens' permissions...

    Permissions are set when creating a token and cannot be modified later. By default, for security reasons, personal access tokens have read-only permissions:

    • Read-only permissions - token will be only allowed to read data from Bamboo that you can normally view. It won’t be allowed to read data, that the associated user cannot read.

    • Triggering permissions - token will be able to start builds and deploy environments that you normally can run. It won’t be allowed to trigger builds or deployments that the associated user cannot run.

    • Same as user - token will have the same set of permission as you (i.e. edit or admin).

    It’s recommended that you assign the lowest possible set of permission to token. This way even if the token gets compromised, it will be possible to perform only a limited set of actions with it.

  6. Record you token in a safe manner. For security reason the token value is shown only once. If you don’t record the token value or lose it you won’t be able to recover it and will have to create a new token.

  7. Click Finish.

Revoking a token

  1. In the upper-right corner, click on you profile image and select Profile.
  2. Click on the Personal access tokens tab.

  3. Hover over your token name.
    The revoke button appears on the right.

  4. Click Revoke.

  5. Click Confirm.
Last modified on Nov 27, 2019

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.