.. index:: token, authentication token

.. _authentication_tokens:

Authentication Tokens
=====================

In order to securely access LAVA resources via XML-RPC APIs using lavacli or
XML-RPC clients, users first need to create an authentication token.

.. _note: An authentication token and a username are sufficient to allow any
   remote user to use that account in LAVA. Take care when sharing scripts that
   the token and username are not disclosed. If a token becomes compromised,
   log in to that LAVA instance and delete the token before creating a new one.

Once logged in to a LAVA instance (e.g. https://validation.linaro.org/), click
on the "API" link then on the "Authentication Tokens" link from the drop down
menu. The following page will appear

.. image:: ./images/authentication-tokens-page.png

Click on the "New" button on the above page which raises a dialog box asking
for a description of the token to help you identify and delete tokens \- if
required at a later stage.

.. image:: ./images/create-new-authentication-token.png

Click on the "Create" button to generate the token. The token will be assigned
a token number (which is autogenerated by LAVA).

.. image:: ./images/sample-token-page.png

To display the token that was generated above click on the green "Display this
token" button in the Actions column on the above page.

.. image:: ./images/token-display-page.png

If a token is compromised, it can be removed by clicking on the red "delete
this token" button in the Actions column. Anyone using that token will then no
longer be able to authenticate as you in the system.
