pelican server token create

pelican-server token create

Create a token

Synopsis

Create a signed JWT for accessing Pelican resources.

The generated token is a Bearer token. To authorize requests with it, pass it to other Pelican CLI commands via the —token flag or in the HTTP Authorization header.

SCOPES

Scopes control what the token permits. Use the flags below to set them, or pass arbitrary values with —raw-scope.

Flag WLCG profile (default) SciTokens2 profile (—profile scitokens2)

—read storage.read:<path> read:<path> —write storage.create:<path> write:<path> —modify storage.modify:<path> write:<path> —stage storage.stage:<path> write:<path>

The <path> in each scope is the object path with the namespace prefix stripped. Use —scope-path to override it, or —raw-scope to supply scopes verbatim, e.g.:

—raw-scope “storage.read:/ storage.create:/uploads”

ISSUER

The issuer (—issuer) is auto-discovered from the Director using the supplied pelican URL. Provide —issuer manually when:

Director discovery is unavailable
The namespace has multiple issuers and you need a specific one

EXPIRATION

Set the token lifetime with —lifetime (seconds, default 1200) or with —expiration (an absolute RFC3339 timestamp, e.g. 2026-12-31T23:59:59Z). These two flags are mutually exclusive.


pelican-server token create <pelican-url> [flags]

Examples


  # Read/write token for a path in OSDF (issuer auto-discovered):
  pelican token create --read --write pelican://osg-htc.org/some/namespace/path

  # Token expiring at a specific time (RFC3339: YYYY-MM-DDTHH:MM:SSZ):
  pelican token create --read --expiration 2026-06-30T00:00:00Z \
    pelican://osg-htc.org/some/namespace/path

  # One-hour token with an explicit issuer:
  pelican token create --read --lifetime 3600 \
    --issuer https://my-origin.com:8443 \
    pelican://osg-htc.org/some/namespace/path

  # Token with custom raw scopes:
  pelican token create --raw-scope "storage.read:/ storage.create:/uploads" \
  pelican://osg-htc.org/some/namespace/path

Options


  -a, --audience string         Specify the token's 'audience/aud' claim. If not provided, the equivalent 'any' audience for the selected profile will be used (e.g. 'https://wlcg.cern.ch/jwt/v1/any' for the 'wlcg' profile).
      --expiration string       Set the token's expiration as an absolute RFC3339 timestamp (e.g., 2026-12-31T23:59:59Z). Mutually exclusive with --lifetime.
  -h, --help                    help for create
  -i, --issuer string           Set the token's 'issuer/iss' claim. If not provided, the issuer will be discovered via the Director.
  -l, --lifetime int            Set the token's lifetime in seconds. (default 1200)
  -m, --modify                  Indicate the requested token should provide the ability to modify/delete the specified resource.
  -k, --private-key string      Path to the private key used to sign the token. If not provided, Pelican will look for the private key in the default location pointed to by the '{IssuerKeysDirectory}' config parameter.
  -p, --profile string          Create a token with a specific JWT profile. Accepted values are scitokens2 and wlcg. (default "wlcg")
      --raw-claim stringArray   Set claims to be added to the token. Format: <claim_key>=<claim_value>.
      --raw-scope stringArray   Set non-typical values for the token's 'scope' claim. Scopes should be space-separated, e.g. 'storage.read:/ storage.create:/'.
  -r, --read                    Indicate the requested token should provide the ability to read the specified resource.
      --scope-path string       Specify the path to use when creating the token's scopes. This should generally be the object path without the namespace prefix.
  -s, --stage                   Indicate the requested token should provide the ability to stage the specified resource.
      --subject string          Set token's 'subject/sub' claim. If not provided, the current user will be used as the default subject.
  -w, --write                   Indicate the requested token should provide the ability to create/write the specified resource. Does not grant the ability to overwrite/modify existing resources.

Options inherited from parent commands


      --config string       config file (default is $HOME/.config/pelican/pelican.yaml)
  -d, --debug               Enable debug log messages
  -f, --federation string   Pelican federation to utilize
      --json                output results in JSON format
  -L, --log string          Specified log output file
      --version             Print the version and exit