Understanding Tokens¶
This section explains how registry access tokens work within the WSO2 Customer Support Portal, including token types, visibility rules, and lifecycle behavior.
Token Types¶
The WSO2 Container Registry supports two distinct token types, each suited to different access scenarios.
User Tokens¶
User Tokens are scoped to the individual user account and are intended for personal, interactive access to the WSO2 registry via the CLI.
- Visible only to the user who created them. Customer Admins can view and manage all User Tokens within the project.
- Remain valid until the subscription expiry date, regardless of any changes to the generating user's account status.
- There is currently no automatic revocation when a user becomes inactive, leaves the project, or has their account suspended or deleted. Customer Admins should manually revoke User Tokens for departing or deactivated users to prevent unintended registry access.
Note
Because User Tokens are scoped to an individual user account, they are not suitable for use in shared infrastructure, CI/CD pipelines, or automated workflows. For these use cases, Service Tokens are recommended.
Service Tokens¶
Service Tokens are scoped to the project rather than to any individual user account, and are intended for service accounts that do not have Support Portal access.
- Generated by a Customer Admin on behalf of a service account (Service User).
- Visible and manageable by all Customer Admins within the project.
- Remain valid until explicitly revoked, or until the subscription expires.
- Unaffected by changes to individual user accounts. Personnel changes, departures, or account suspensions have no impact on an active Service Token.
Token Visibility¶
Token visibility differs based on the user's role within the project.
| Token / Action | Customer User | Customer Admin |
|---|---|---|
| Own User Tokens | Visible | Visible |
| Other users' tokens | Not visible | Visible |
| Service Tokens | Not visible | Visible |
| Can revoke any token | No | Yes |
This design keeps personal credentials private for regular users while giving Customer Admins the oversight needed to manage access across the project.
Choosing the Right Token Type¶
| Use Case | Recommended Token Type |
|---|---|
| Personal CLI access to the WSO2 registry | User Token |
| CI/CD pipelines and automated deployments | Service Token |
| Shared integrations across multiple team members | Service Token |
| Service accounts without Support Portal access | Service Token |
Important
The Token Secret is displayed only once at the time of generation. Ensure the secret is stored securely before closing the generation window. If the secret is lost or forgotten, it cannot be recovered; a new secret must be generated using the Re-generate Secret action, which will immediately invalidate the existing one.