Creating user analysis tokens in SonarQube Server

(music) (pulse) (chime) User tokens are a secure way to perform actions on behalf of a specific user. In this short video, you'll learn the purpose of SonarQube Server user tokens and how to generate one in SonarQube. Let's get started! So, what is a user token? A user token is a secure, string-based credential you generate from a SonarQube Server account. It acts as a password for the API and has the same permissions as the user who generated it. and has the same permissions as the user who generated it. This allows external tools or scripts to perform user-level actions and authenticate in SonarQube without needing a username or password. User tokens are a suitable choice when using scripts or tools to interact with the SonarQube Web API to interact with the SonarQube Web API for tasks like managing projects or permissions. They provide the specific user identity needed for authorization. Remember, that the actions you will be able to perform via API with your user token are limited to the global or project permissions you’re assigned. Please refer to Sonar’s Web API documentation for the required permissions for a specific API call. Now, let's create the token. First, sign on to your SonarQube Server instance using the user account that needs the token. Next, navigate to your user account settings by selecting your profile icon. From the menu, select the Security tab. This is where you'll manage all of your authentication tokens. In the Generate Tokens section, give your new token a descriptive name. This will help you easily identify its purpose later. Next, from the Type drop-down menu, select User Token. You can also set an expiration date for your token. While No expiration is an option, it’s a best practice to set an expiration date to force regular rotation. Then, click Generate. And, here's the most important part! You must copy this token and save it in a secure location right now, like a password manager or your DevOps platform’s secret store. This is the only time you will see this token value. You can now use this token as a secure and controlled way to perform actions in SonarQube, all while keeping your personal password safe. If you are an administrator, there is an alternative way to generate user tokens on behalf of other users. Go to Administration > Security > Users, and then click on the triple dots below the Tokens column. This will be a faster method for generating tokens for other users. And that’s it! See our additional videos to dive deeper into other Sonar topics. (chime)