Skip to main content

​
Types of access tokens

Semgrep uses the following types of access tokens:
  • API tokens
  • CLI tokens
  • Service tokens

​
API tokens

API tokens can be created by admins and are used for calls to the Semgrep API and to set up third-party integrations. For auditing purposes, API tokens are associated with the user who created them. However, they remain valid until manually revoked, even if the creator is no longer associated with the deployment.

​
CLI tokens

CLI tokens authenticate users who run scans or publish rules from the Semgrep CLI. Both members and admins of a deployment can create CLI tokens. The CLI token allows users to run scans on their local machine using the semgrep ci command. This sends findings data to Semgrep AppSec Platform. It also allows users to publish rules using semgrep publish. For auditing purposes, Semgrep records the user who generated the CLI token, but the user’s actions are attributed to the token rather than the user. Logging out of the Semgrep CLI with semgrep logout removes the local token, but it does not invalidate it.

​
Service tokens

Service tokens are functionally the same as API tokens, but instead of being manually generated by a user, they are automatically generated during repository onboarding for CI/CD scans or when repositories are added to Semgrep AppSec Platform. These tokens authenticate agents running automated scans. The default scope for these tokens is Agent/CI, but admins can edit the token and grant them the API scope as well.

​
Token scopes

When you create an API token, select one of the following scopes. Scopes are mutually exclusive.
  • Agent (CI): Connect scans with the platform to request rules, send findings, and post PR or MR comments.
  • Web API: Call the Semgrep Web API, including write operations.
  • Member: Permissions aligned with a Member of the deployment.
  • Read-only: Call only the read APIs—a subset of full Web API access—so the token can retrieve data without making changes. Use a read-only token for products such as Semgrep Guardian, without provisioning a fully permissive Web API token.
After you create a Read-only token, you cannot change its scope to a more permissive one. This prevents a token that started as read-only from being assigned higher permissions later. To grant broader access, create a new token with a different scope, then revoke the read-only token if it is no longer needed.
The following table displays typical capabilities by token type: The following table displays typical uses for token types:

​
View and manage tokens

You can view a list of tokens for your deployment in Semgrep AppSec Platform under Settings > Tokens. Each token type has its own page that lists all existing tokens of that type. Use the search bar to help find a specific token. For API tokens, you can use the drop-down menu to view only those tokens associated with a specific scope, such as Agent (CI), Web API, Member, or Read-only. For Service tokens, you can use the drop-down menu to view tokens for specific services, such as Semgrep Managed Scans, Autofix, or AI Scan.

​
Create an API token

1
Sign in to Semgrep AppSec Platform.
2
Go to Settings > Tokens > API tokens.
3
Click Create new token.
4
Copy the Secrets name and the Secrets value, and save these values. The Secrets value is your token and is only shown at this time.
5
Under Token scopes, select one scope: Agent (CI), Web API, Member, or Read-only.
6
Optional: change the Name of the token. This is the value used in the list of tokens associated with your Semgrep deployment.
7
Click Save to proceed.

​
Create a CLI token

Once you’ve set up the Semgrep CLI, create a CLI token by running the following command:
Running this command launches a browser window, but you can also use the link that’s returned in the CLI to proceed. In the Semgrep CLI login window, click Activate to proceed.

​
Edit a token

You can rename a token and, for some token types, change its scope. You cannot change a Read-only token to a more permissive scope. Create a new token instead.
1
Sign in to Semgrep AppSec Platform.
2
Go to Settings > Tokens.
3
Go to one of the following pages based on the type of token you’re interested in: API tokens, CLI tokens, or Semgrep service tokens.
4
Find the token, and click Edit.
5
In the dialog that appears, change the displayed Name or, if the UI allows it for that token, the Token scopes. You cannot change the scope of a Read-only token.
6
Click Save to proceed.

​
Revoke a token

1
Sign in to Semgrep AppSec Platform.
2
Go to Settings > Tokens.
3
Go to one of the following pages based on the type of token you’re interested in: API tokens, CLI tokens, or Semgrep service tokens.
4
Find the token, and click Revoke.