Creating scoped organization tokens in SonarQube Cloud

(music) (pulse) (chime) Welcome! Scoped organization tokens in SonarQube Cloud securely authenticate SonarScanner runs, usually performed in CI/CD pipelines for code analysis. In this short video, you'll learn the purpose of scoped organization tokens and how to generate one in SonarQube Cloud. This is a crucial step for setting up secure, automated analysis across all your organization’s projects. Let's get started. So, what are scoped organization tokens? Scoped organization tokens are secure, project-specific tokens created at the organization level. They replace user tokens for CI/CD in SonarQube Cloud, making it easier to automate code analysis across all projects, even if the user who created it leaves the company. It's important to understand that these tokens are not global organization tokens. They are limited, or scoped, to specific projects you select within your organization. If you need to include more projects later, you can update the existing token's scope instead of creating a new token. With SonarQube Cloud Team and Enterprise plans, organization administrators can create, manage, and revoke the tokens. Currently, these tokens can only be used to execute analysis on the projects. Let's go through how to create a scoped organization token. Once you've logged in, go to the Account menu and select your organization. Navigate to Administration and select Scoped Organization Tokens. And then, click Create token. Give your token a name and a description, such as Organization-Token. Be descriptive, so you can easily identify its purpose later. Next, you need to set an expiration date. You can select a preset or custom date. When a token expires, all pipelines that rely on that token will stop working. Under Projects scope, select the specific projects to which this token should have access. Then, click Generate token. And, here's the most important part! You must copy this token and save it in a secure location right now, like a password manager or your CI/CD's secret store. This is the only time you’ll see this token value. You'll be able to easily spot the scoped organization tokens because they all start with the prefix "sqco_". Now that you've created a scoped organization token, it’s ready to be used by your CI/CD workflows and SonarScanner analysis to securely communicate with SonarQube. Next, managing your tokens is just as easy. From the same screen, you can select the ellipsis and either revoke or view the details of each token. You'd need to revoke a scoped organization token for security, like immediate action after a compromise, or for administrative hygiene, such as retiring a pipeline or rotating an expired key. In conclusion, using scoped organization tokens is a simple and effective way to enhance security and streamline project administration. And, that's a wrap! See our additional videos to dive deeper into Sonar topics. (chime)