Create an API token using an API request

[ivangfr]

Hi,

I've seen here that we need to access Unleash UI to create the API token. Is it the only way?

It would be great if we could get it from an API request so that we can start our development environment easily.

For instance:

1. Spin up an Unleash Docker container locally in my machine.
2. Once it's up and running, run a curl command to create an API token;
3. Use this API token to create a feature toggles

Best regards,

[thomasheartman]

Hey!

Yeah, you can use the API tokens API. The create API token operation should do that for you.

However, you will need an API token to use the API in the first place, so it might be that you're better off starting Unleash with API tokens already present. You can do that using the INIT_ADMIN_API_TOKENS/INIT_CLIENT_API_TOKENS environment variables as mentioned in the further customization section of the Configuring Unleash document .

Let me know if that gives you what you need ☺️

[ivangfr]

Hi @thomasheartman Thanks for the fast response 😄

Let me show I am trying

# create docker network
docker network create unleash-api-test-network

# run postgres docker container
docker run --rm --name postgres \
  -p 5432:5432 \
  -e POSTGRES_USER=unleash_user \
  -e POSTGRES_PASSWORD=unleash_password \
  -e POSTGRES_DB=unleash \
  --network=unleash-api-test-network \
  --health-cmd="pg_isready -U postgres" \
  postgres:15.2

# run unleash docker container
docker run --rm --name unleash \
  -p 4242:4242 \
  -e DATABASE_URL=postgres://unleash_user:unleash_password@postgres/unleash \
  -e INIT_CLIENT_API_TOKENS='[{"environment": "*", "project": "*", "secret": "*:*.some-random-string", "type": "ApiTokenType.CLIENT", "username": "some-user"}]' \
  -e DATABASE_SSL=false \
  -e LOG_LEVEL=debug \
  --network=unleash-api-test-network \
  --health-cmd="nc -z localhost:4242" \
  unleashorg/unleash-server:4.21.0

Checking Unleash logs, I am getting an ERROR, "Unable to create initial Admin API tokens"

[DEBUG] server-impl.js - DB migration: start
[DEBUG] server-impl.js - DB migration: end
[DEBUG] /middleware/pat-middleware.ts - Enabling PAT middleware
[DEBUG] /middleware/api-token.ts - Enabling api-token middleware
[DEBUG] /middleware/rbac-middleware.ts - Enabling RBAC middleware
[DEBUG] /middleware/maintenance-middleware.ts - Enabling Maintenance middleware
[INFO] server-impl.js - Unleash has started. { address: '::', family: 'IPv6', port: 4242 }
[DEBUG] server-impl.js - Registering graceful shutdown
[ERROR] /services/api-token-service.ts - Unable to create initial Admin API tokens

Am I missing or doing something wrong?

Thanks!

[thomasheartman]

No worries! And yeah, I think I see what you're doing. There's a few things I'd like to clarify.

First off, this line:

-e INIT_CLIENT_API_TOKENS='[{"environment": "", "project": "", "secret": ":.some-random-string", "type": "ApiTokenType.CLIENT", "username": "some-user"}]' \

should be something like this instead

-e INIT_CLIENT_API_TOKENS='*:development.some-random-string' \

As explained in the docs, when you use environment variables, you should provide a comma-separated list of the tokens

You can use the environment variables INIT_ADMIN_API_TOKENS or INIT_CLIENT_API_TOKENS to create API admin or client tokens on startup. Both variables require a comma-separated list of API tokens to initialize (for instance *:*.some-random-string, *:*.some-other-token). The tokens found in INIT_ADMIN_API_TOKENS and INIT_CLIENT_API_TOKENS will be created as admin and client tokens respectively and Unleash will assign usernames automatically.

The other thing is about the token type that you're creating. You said you wanted to create an API token and:

Use this API token to create a feature toggles

If you want to be able to create features, you will need an admin token (or a personal access token, but these can't be created on startup). Client tokens only get access to the read-only client API and can not create features themselves.

But I would also like to stress that none of Unleash's client SDK can create features, and that they should not be used with admin tokens.

So if you want a token that can create features, you'll need an admin token. If you want to use it for SDKs, you should make a client token.

Finally, there's the thing about formats: client tokens can only access a single environment. So a client token would look like *:development.whatever. The one you used in your example uses * for environments. Only admin tokens and personal access tokens can get access to multiple environments. This is also mentioned in the API token reference documentation.

Hope that clarifies it a bit. If you've got any more questions, don't hesitate to ask and I'd be happy to help ☺️

[ivangfr]

Hey @thomasheartman thanks for the detailed explanation. I was able to achived my goal 😄

So, here is my pseudo-script

# create docker network
docker network create unleash-api-test-network

# run postgres docker container
docker run --rm --name postgres \
  -p 5432:5432 \
  -e POSTGRES_USER=unleash_user \
  -e POSTGRES_PASSWORD=unleash_password \
  -e POSTGRES_DB=unleash \
  --network=unleash-api-test-network \
  --health-cmd="pg_isready -U postgres" \
  postgres:15.2

# run unleash docker container
docker run --rm --name unleash \
  -p 4242:4242 \
  -e DATABASE_URL=postgres://unleash_user:unleash_password@postgres/unleash \
  -e INIT_ADMIN_API_TOKENS='*:*.some-random-string' \
  -e INIT_CLIENT_API_TOKENS='*:development.some-random-string' \
  -e DATABASE_SSL=false \
  -e LOG_LEVEL=debug \
  --network=unleash-api-test-network \
  --health-cmd="nc -z localhost:4242" \
  unleashorg/unleash-server:4.21.0

# create feature toggle
curl -i -X POST 'http://localhost:4242/api/admin/projects/default/features' \
  -H 'Authorization: *:*.some-random-string' \
  -H 'Content-Type: application/json' \
  -d '{ "type": "release", "name": "my-toggle" }'

In short, I am initializing two tokens, one for ADMIN (*:*.some-random-string) and another for CLIENT (*:development.some-random-string).

• the ADMIN token, I use to create the feature toggle;
• the CLIENT token, I use in my application.

It works perfectly. Thanks again!