Access tokens authenticate access to Cloud Native Build Platform resources (code repositories, artifact repositories, OpenAPI, etc.).

When to use: when you need to read or write CNB resources as an individual — for example cloning a private repository locally, calling the OpenAPI from a script, or connecting to a repository from a third-party tool. Grant the token only the scopes it needs, following the principle of least privilege.

Creating an Access Token

After logging in, navigate to Personal Settings → Access Token → Add Access Token, and configure the following parameters:

• Token Name: Unique identifier
• Expiration Time: Token becomes unusable after expiration
• Scope of Use: Repository types the token can access
• Authorization Scope: Operational permissions
• Common Scenarios: Quick initialization of authorization scope based on usage scenarios

Default Permissions

After creation, access tokens have read-only permissions on public organizations/repositories/ registries/missions by default, no permissions on private repositories and registries, and no permissions on account-related operations by default. To access private resources, explicitly select the corresponding authorization scopes.

Usage

For code repositories and artifact repositories, the username is always cnb and the password is the access token.

For example, to clone a private repository, enter that username and your access token when prompted:

# Clone a private repository, then enter your username and password when prompted
git clone https://cnb.cool/group-path/repo-path

For the OpenAPI, pass the token as Bearer in the Authorization header; see Open API.

CI Temporary Tokens

Pipelines embed temporary tokens (automatically destroyed at the end of the pipeline), obtainable through the environment variable CNB_TOKEN.

Previous pageRole Permissions

Next pageDeploy Key