Personal access token (SaaS)

Learn how to use personal access tokens for authentication in Exasol SaaS.

A personal access token (PAT) is needed to authenticate when connecting to an Exasol SaaS database through JDBC, ODBC, ADO.NET, or WebSockets, and when using the Exasol SaaS REST API.

Personal access tokens provide access to your data and should be protected accordingly. To learn about how to keep your tokens safe, see PAT security best practices.

Scope of personal access tokens

The level of access that the token will grant in the web console and in the REST API is determined by assigning scopes. When you create a token you must select at least one scope in one of the following categories:

Category	Scope	Acess rights
Database	Use	View and connect to databases that you have access to
Database	Use & Operate	Full access to the databases, including: View databases and clusters Connect to databases and clusters Start and stop databases Create new databases Create new clusters Delete a cluster
Users	Read	View the list of users in your organization
Users	Read & Write	View, invite, and remove users in your organization
Security	Read	Read the IP addresses in the allowed list
Security	Read & Write	Read, add, and remove IP addresses in the allowed list
Billing	Read	View the current billing information, including credit card details
Billing	Read & Write	View and update billing details, including adding or updating credit card details
Monitoring	Read	View usage details for the organization, including compute, storage, and network usage
File management	Write	Access to the file management APIs

Database access

A personal access token inherits the exact database permissions of the user who creates the token. This means that if the user who creates the token has DBA privileges (full admin rights), the token will grant DBA access to the database.

To learn more about how to manage database access for Exasol SaaS users, see Manage Exasol SaaS users.

Create a personal access token

In the web console, open your profile menu and select Personal access tokens.
The Personal Access Tokens window shows any existing tokens in the current account and allows you to create and revoke tokens.

To create a new token, click on Create token.
In the Create personal access token dialog, enter a descriptive name for the token and select the desired scope.
Click on Generate to generate the new token.

If your profile is not complete you will be asked to complete it before the token can be generated.
When the token has been generated it will be displayed as a message in the Personal Access Tokens window. Click on copy to copy the token to your clipboard.

The token is only shown once and will disappear when you close or refresh the page. Make sure that you copy the token and store it in a safe location. The token cannot be retrieved later.

Revoke a token

If a token is no longer needed, you can revoke it.

In the web console, open your profile menu and select Personal access tokens.
In the Personal Access Tokens window, click on ... and select Revoke.
In the confirmation window, click on Revoke to revoke the token, or click on Close to cancel the operation.

PAT security best practices

Follow these best practices to keep your personal access tokens safe:

Rotate the tokens on a regular basis. Personal access tokens do not have expiry dates.

To learn how to create a new token, see Create a personal access token.
Limit the scope of the token. Grant only the permissions that are necessary for its intended purpose.
Revoke the tokens if you suspect that they could have been compromised, and as soon as they are no longer needed.

To learn how to revoke a personal access token, see Revoke a token.
Store the tokens in secret stores. Never commit them to source control.
Do not share tokens across users and environments.
Follow best practices and guidelines set out by your own organization.
For more guidance, see also the Secrets Management Cheat Sheet published by OWASP.