Tokens and API keys

Node enrolment tokens and the API keys of the REST API and the MCP server.

Create the two kinds of credential that are not users: enrolment tokens, with which a new node joins, and API keys, with which the REST API and the MCP server are called.

Requirements

Access to teseladb admin on a node of the cluster.

Node enrolment token

Shell

teseladb admin token create --ttl 1h

The token is single-use, expires and carries the fingerprint of the cluster CA.

API key

Shell

teseladb admin apikey create
teseladb admin apikey list
teseladb admin apikey revoke <id>

An API key belongs to a user, carries a subset of its roles and expires after 90 days by default. It is shown only once, when created. Its value starts with tdb_.

Check

teseladb admin apikey list shows the new key without its value, with its user and its expiry.

Common problems

The REST API refuses the call because the key expired or was revoked. Create another.