Generate and manage organization and workspace-level service access tokens in RudderStack.
Available Plans
starter
growth
enterprise
4 minute read
A Service Access Token (SAT) enables applications access to RudderStack APIs, providing a flexible, secure, and centralized way for you to programmatically interact with resources and services in the platform.
Unlike Personal Access Tokens which are tied to individual users, SATs provide centralized access to resources within an Organization or Workspace, ensuring continuity and reducing the risk of disruptions when members are removed or their roles change.
Operations performed with SATs are logged and audited against the SAT, ensuring that activities are traceable to the token rather than an individual user.
Personal Access Tokens vs. Service Access Tokens
Personal Access Tokens (PAT)
Service Access Tokens (SAT)
Tied to a specific user within a workspace.
Not tied to an individual user.
Used for individual tasks and testing.
Used for centralized, shared access and production use cases.
Any processes dependent on the tokens will break if the user is removed from the organization or a breaking change is made to their permissions.
Exist at the Organization or Workspace level, ensuring the essential workflows and pipelines using the token remain functional.
RudderStack recommends using:
SATs for your production use cases that require shared access to the services and resources across the organization or workspace.
PATs for testing a service/feature or personal use cases.
Service Access Token types
Organization-level SATs
Organization-level SATs are associated with the entire organization. You can use them for authenticating your SSO SCIM and the Audit Log API.
Organization-level SATs have the Org Admin permissions by default.
Workspace-level SATs
As workspace-level SATs are linked to a specific workspace, their usage is restricted to workspace-level resources (Sources, Destinations, Transformations, Tracking Plans, etc.) and APIs. This ensures they cannot interact with organization-level functionalities like audit logs or SCIM provisioning.
Generate Service Access Token
Note that:
Only Org admins can create, view, and delete organization-level and workspace-level SATs.
The actual value of the SAT is visible only to the creator at the time of creation.
You will see the below settings depending on the tab chosen in Step 2:
Enter the name of the SAT and click Generate.
Note the token value.
Make sure to secure the token. You will not be able to see it again once you click Close.
Enter the name of the SAT.
Choose the relevant workspace from the dropdown (applicable for a multi-workspace setup).
Under Token role and permissions, assign the relevant workspace role for the token. You can choose between Admin, Editor, or Viewer, depending on your requirement.
Ensure proper assignment of roles and resource permissions to SATs to avoid unauthorized access to sensitive resources.
Optionally, toggle on the Grant edit access setting to create, edit, or delete Transformations using the token.
Click Generate.
Note the token and use it in the relevant workspace-level APIs and services.
Make sure to secure the token. You will not be able to see it again once you click Close.
You can leverage RudderStack’s advanced permissions settings to set granular access controls that determine which SATs can modify (edit or delete) specific resources.
Go to the resource and click the Permissions tab:
You will see the following options under the Who can make changes? section:
Members and tokens with Editor permissions: All the members and service access tokens with the Editor permissions can make changes to the resource.
Only people and Service Access Tokens you select: Only the specified members and access tokens can make changes to the resource.
To allow edit access to specific SATs within your workspace, click Only people and Service Access Tokens you select and click the Service Access Tokens tab. Then, click Add tokens.
In the right sidebar, select the tokens from the dropdown and click Add tokens:
This site uses cookies to improve your experience while you navigate through the website. Out of
these
cookies, the cookies that are categorized as necessary are stored on your browser as they are as
essential
for the working of basic functionalities of the website. We also use third-party cookies that
help
us
analyze and understand how you use this website. These cookies will be stored in your browser
only
with
your
consent. You also have the option to opt-out of these cookies. But opting out of some of these
cookies
may
have an effect on your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This
category only includes cookies that ensures basic functionalities and security
features of the website. These cookies do not store any personal information.
This site uses cookies to improve your experience. If you want to
learn more about cookies and why we use them, visit our cookie
policy. We'll assume you're ok with this, but you can opt-out if you wish Cookie Settings.