Managing Scoped Organization Tokens

Scoped Organization Tokens are available starting in Team plan.

Scoped Organization Tokens are used to run analyses on your code. To do so, the sonar.token property is used. For more details see Analysis parameters.

You must be an organization admin to be able to retrieve and manage Scoped Organization Tokens.

About Scoped Organization Tokens

Scoped Organization Tokens provide a secure way to manage non-user-specific authentication. Attached to an organization, they are created and managed by the organization admin who can revoke them anytime. Revoked tokens are automatically deleted.

Scoped Organization Tokens comply with the principle of least privilege through its scope definition:

• You define the projects within the organization to which the token gives access. Currently, you can only limit the access to a list of existing projects.

• You define the permissions granted by the token. Currently, you can only grant the Execute analysis permission but other permissions will be supported soon.

You can define any expiry date for your Scoped Organization Token, or no expiration. The different token statuses are:

• Active

• About to expire (in less that 7 days)

• Expired

Retrieving and viewing Scoped Organization Tokens

1. Retrieve your organization. See Retrieving your organizations for more details.

2. Go to Administration > Scoped Organization Tokens.

1. In the list of tokens, locate the token you want to view and select the Actions menu at the end of the row.

2. In the menu, select View details.

Creating a Scoped Organization Token

1. Retrieve your organization. See Retrieving your organizations for more details.

2. Go to Administration > Scoped Organization Tokens.

3. In the top right corner, select the Create token button.

4. Enter the token name and description. Choose a name that accurately represents the token purpose.

5. In Expires in, select the token lifetime or select No expiration.

1. In Project scope, select Select projects. The Projects scope dialog opens.

2. Select the projects to which the token will give access.

1. Close the dialog.

2. Select the Generate token button. A message pops up to notify the successful token generation.

3. Immediately copy the generated token from the notification message. Once you’ve left the notification, you won’t be able to view the token value any more.

1. You can now close the notification.

Revoking a Scoped Organization Token

When you revoke a Scoped Organization Token, it’s automatically deleted.

To revoke a Scoped Organization Token:

1. Retrieve your organization. See Retrieving your organizations for more details.

2. Go to Administration > Scoped Organization Tokens.

3. In the list of tokens, locate the token you want to revoke and select the Actions menu at the right end of the row.

4. In the menu, select Revoke. A confirmation dialog opens.

5. Confirm. The token disappears from the list of tokens.