Configure the API Tokens Management Feature

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

Applies from release 2020.3

There are a number of parameters in alation_conf that help administer the API Tokens Management functionality: Generate Tokens for the Alation API.

You can configure:

  • The expiration period for API tokens

  • Whether users in non-admin roles can create API tokens from the Alation UI

On how to use alation_conf and set parameter values, see Using alation_conf .

Note

Alation Cloud Service customers can request server configuration changes through Alation Support.

Configure the Expiration Period for API Tokens

Use the parameters described below to configure the expiration period for API tokens. No restart is required after the values are changed; allow 1–3 minutes for the new value to take effect.

Server Admins can manage these settings from Admin Settings > Feature Configuration. The UI enforces the minimum and maximum bounds shown in the table below; saving a value outside the allowed range fails with a validation error.

Where the settings appear depends on the user experience:

  • New User Experience: under the System & Administration section (or tab) of Feature Configuration. Look for API access token lifetime and API refresh token lifetime.

  • Classic User Experience: directly in the Feature Configuration list, under the same setting names.

Parameter

Values

Description

alation.authentication.token.access_token_lifespan

Number (hours)

Sets the lifetime for the API access token in number of hours.

  • Default: 24

  • Minimum: 1

  • Maximum: 72

alation.authentication.token.refresh_token_lifespan

Number (days)

Sets the lifetime for the API refresh token in number of days.

  • Default: 90

  • Minimum: 1

  • Maximum: 180

These limits apply to V1 API tokens only. They do not apply to OAuth 2.0 tokens issued by the Alation OAuth server. Existing instances that already have an out-of-range override in alation_conf keep their existing value; Alation enforces the new bounds only when a Server Admin saves the setting from the UI or the public API.

A change to either expiration parameter applies to new tokens only. Tokens that were already issued keep their original expiration and continue to be valid until that original expiration. To shorten an existing token’s effective lifetime, revoke it and issue a new one.

Hide the API Token Creation UI from Alation

Use the parameter alation.authentication.token.enable_v1_gui_for_all_users to disable the UI for all users except Server Admins. This parameter controls the appearance of the Access Tokens section on the Account Settings > Authentication page:

../../_images/API_tokens07.png

The default value is True, which means all users see the Access Token sections in Account Settings > Authentication.

Set this parameter to False to hide this section from all user roles except Server Admins. No restart is required.

Note

This parameter only hides the ability to create API tokens from the Alation UI. It does not disable the functionality of API tokens creation and usage. The functionality itself cannot be disabled as the use of APIs always requires an Access token to be passed in the request header.

If the Access Tokens section is hidden from the UI, the only means to create API tokens is the Token Management API.

The pre-2020.3 Token API and Legacy V0 Tokens

Important

Support for the pre-2020.3 GET Token API and the legacy User V0 tokens it issued has been removed in release 2026.2.1.0. The API no longer accepts requests, and existing User V0 tokens are no longer accepted by Alation. Migrate integrations and automation workflows to:

  • Alation Cloud Service: OAuth 2.0 tokens issued by the Alation OAuth server (preferred). API access tokens (V1) remain supported as a fallback.

  • Customer Managed: API access tokens (V1).

For the full End-of-Life notice and migration guidance, see End of Life: User V0 Tokens.