---
title: "CLI - Manage access tokens"
description: "Learn how to create application tokens for AI Training."
url: https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/cli-app-token
lang: en
---
> For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt.

# CLI - Manage access tokens

**Learn how to create application tokens for AI Training.**

 

## Requirements

- A working `ovhai` CLI (learn more [here](https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/cli-install-client.md))

 

## Instructions

### Token creation help

If you need any help while creating a new token, run `ovhai token create --help`:

```
Usage: ovhai token create [OPTIONS] --role <ROLE> <NAME>

Create an application token

Arguments:
  <NAME>  Token's name

Options:
  -r, --role <ROLE>                  Operator role gives all access, read role only allow to access job's APIs. DEPRECATED VALUES: "read", "operator" => replaced by "ai_training_read", "ai_training_operator" [possible values: read, operator, ai_training_read, ai_training_operator, quantum_operator, quantum_reader]
      --token <TOKEN>                Authentication using Token rather than OAuth
  -l, --label-selector <name=value>  Only jobs with this label's name and value will be accessible using this token
  -o, --output <OUTPUT>              Command output format [possible values: json, yaml, description]
      --no-color                     Remove colors from output
  -h, --help                         Print help
```

 

### Create an app token

The creation of application tokens is pretty straightforward; you need to define what roles to assign to the token and its scope.

There are two roles available:

- `read`: A token with this role will allow access to the services exposed by the job on the `job_url`.
- `operator`: A token with this role will allow interaction with AI Training API and CLI.

The tokens can be scoped to apply only to jobs matching a specific label. Upon creating a token simply provide a `name=value` pair and when running a new job add the label to the job to be accessible `ovhai job run -l name=value`. If you create a new job using an app token the `label-selector` is automatically added to the created job so that it falls within the token scope.

Let us create a new `operator` token scoped to `model=base` and named `basetoken`:

```
ovhai token create basetoken --label-selector model=base --role operator
```

**Warning:**

An unscoped token will have access to all jobs.

 

### Use the app token

If your token has a role `read` and you wish to access the `job_url` or if it is an `operator` token and you wish to use the AI Training API, simply add the following header to your HTTP requests:

```
-H 'Authorization: Bearer <token>'
```

You can also use the `operator` token directly with the `ovhai` CLI. For all commands, simply add the flag `--app-token` to override the default authentication method. Running a simple `Hello World` with the app token :

```
ovhai job run --app-token <my-token> ubuntu -- echo `Hello World`
```

 

### Token lifecycle

Application tokens do not have an expiration date. We need an additional mechanism to revoke those tokens and remove access to unwanted applications.

There are two ways to revoke a token.

 

#### token delete

You can delete any token using its ID. List the tokens and find the `ID` associated with your token. Then simply run:

```
ovhai token delete <token-id>
```

 

#### token renew

You may wish to revoke a token while keeping its name and `label-selector`, a typical use case is if your token leaked or is compromised in any way. Rather than deleting and recreating the token, you can renew it. Simply run:

```
ovhai token renew <token-id>
```

 

## Go further

Browse all the [AI & Machine Learning guides](https://docs.us.ovhcloud.com/en/public-cloud/ai-machine-learning/landing-page-ai-machine-learning.md).

Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services.

Learn more about [AI & Machine Learning](https://us.ovhcloud.com/public-cloud/ai-machine-learning/) on the OVHcloud US website.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.