Service Access Tokens

A Service Access Token (SAT) enables applications access to RudderStack APIs, providing a flexible, secure, and centralized way for you to programmatically interact with resources and services in the platform.

Overview

Unlike Personal Access Tokens which are tied to individual users, SATs provide centralized access to resources within an Organization or Workspace, ensuring continuity and reducing the risk of disruptions when members are removed or their roles change.

Operations performed with SATs are logged and audited against the SAT, ensuring that activities are traceable to the token rather than an individual user.

Personal Access Tokens vs. Service Access Tokens

RudderStack recommends using:

• SATs for your production use cases that require shared access to the services and resources across the organization or workspace.
• PATs for testing a service/feature or personal use cases.

Service Access Token types

Organization-level SATs

Organization-level SATs are associated with the entire organization. You can use them for authenticating your SSO SCIM and the Audit Log API.

Organization-level SATs have the Org Admin permissions by default.

Workspace-level SATs

As workspace-level SATs are linked to a specific workspace, their usage is restricted to workspace-level resources (Sources, Destinations, Transformations, Tracking Plans, etc.) and APIs. This ensures they cannot interact with organization-level functionalities like audit logs or SCIM provisioning.

Generate Service Access Token

Note that:

• Only Org admins can create, view, and delete organization-level and workspace-level SATs.
• The actual value of the SAT is visible only to the creator at the time of creation.
• The organization-level service access token can be used only for authenticating your SSO SCIM and the Audit Log API.

1. Go to Settings > Organization > Service Access Tokens tab.

2. Click the Organization or Workspace tab depending on whether you want to generate an organization-level SAT or workspace-level SAT.
3. Click Generate new token.

You will see the below settings depending on the tab chosen in Step 2:

1. Enter the name of the SAT and click Generate.

2. Note the token value.

Make sure to secure the token. You will not be able to see it again once you click Close.

1. Enter the name of the SAT.
2. Choose the relevant workspace from the dropdown (applicable for a multi-workspace setup).
3. Under Token role and permissions, assign the relevant workspace role for the token. You can choose between Admin, Editor, or Viewer, depending on your requirement.

Ensure proper assignment of roles and resource permissions to SATs to avoid unauthorized access to sensitive resources.

4. Optionally, toggle on the Grant edit access setting to create, edit, or delete Transformations using the token.
5. Click Generate.

6. Note the token and use it in the relevant workspace-level APIs and services.

Make sure to secure the token. You will not be able to see it again once you click Close.

Assign resource permissions to SATs

This feature is available only in RudderStack’s Enterprise plan. See the Permissions Management guide for more information.

You can leverage RudderStack’s advanced permissions settings to set granular access controls that determine which SATs can modify (edit or delete) specific resources.

1. Go to the resource and click the Permissions tab:

2. You will see the following options under the Who can make changes? section:

   • Members and tokens with Editor permissions: All the members and service access tokens with the Editor permissions can make changes to the resource.
   • Only people and Service Access Tokens you select: Only the specified members and access tokens can make changes to the resource.

3. To allow edit access to specific SATs within your workspace, click Only people and Service Access Tokens you select and click the Service Access Tokens tab. Then, click Add tokens.

4. In the right sidebar, select the tokens from the dropdown and click Add tokens:

Note that:

• You can add only workspace-level service access tokens. Organization-level service access tokens are not available for selection.
• You cannot add tokens with read-only (Viewer) permissions as they do not have the ability to modify a resource, by default.

Questions? Contact us by email or on Slack