Skip to main content
API7.ai Logo

Admin Tokens

Admin tokens let automation call the AISIX Cloud Admin API without a browser session.

They are intended for organization-level workflows such as CI pipelines, infrastructure automation, or internal tools that manage control-plane resources. They are not caller API keys for gateway traffic or upstream provider keys for model access.

An admin token belongs to one organization. The control plane uses that organization binding when it authenticates the request, so API calls do not need a separate organization header.

Create an Admin Token​

Only organization owners can create or revoke admin tokens.

  1. Open Admin tokens.
  2. Select New token.
  3. Enter a unique name.
  4. Choose an expiration period, or select Never.
  5. Select one or more scopes.
  6. Create the token and copy the plaintext value before leaving the one-time view.

Generated admin tokens use the aisix_pat_ prefix. After displaying the plaintext value once, the control plane stores only its SHA-256 digest. If you lose the plaintext value, revoke the token and create a replacement.

Choose Scopes​

Admin tokens support the following scopes:

ScopeAccess
readRead-only access to AISIX Cloud Admin API routes.
writeRead and write access to AISIX Cloud Admin API routes.
scimAccess only to the SCIM directory sync endpoints under /scim/v2.

Use read for inventory or reporting jobs. Use write only when automation needs to create, update, or delete control-plane resources.

SCIM tokens follow a separate creation flow: generate them in Settings, under Directory sync (SCIM). The scim scope cannot be combined with other scopes, and these tokens are rejected on non-SCIM routes. This limits the identity provider credential to directory provisioning.

Use an Admin Token​

Send the token in the Authorization header as a bearer token:

export AISIX_TOKEN="YOUR_ADMIN_TOKEN"

curl -sS "https://<your-cp-api-host>/api/environments" \
  -H "Authorization: Bearer ${AISIX_TOKEN}"

Use the AISIX Cloud Admin API Reference for routes covered by the public OpenAPI specification. Workflow guides may also provide task-specific examples. For example, Members shows how to create a member for API key ownership.

Rotate or Revoke Tokens​

To rotate an admin token, create a replacement, update the automation that uses it, verify that the automation succeeds, and then revoke the old token.

Revocation takes effect immediately. Requests that use the revoked token receive authentication errors.

Next Steps​

After creating an admin token with the write scope, continue with Connect an AISIX Gateway to attach the runtime that will receive environment resources and serve AI traffic.

To configure organization access instead, continue with Members. For identity-provider provisioning, see SCIM Directory Sync.