Security on Layer5 Documentation

Create and Use an API Token

Mon, 01 Jan 0001 00:00:00 +0000

An API token lets a script, a CI job, or a Meshery client act as your user account against Layer5 Cloud. This guide creates one, uses it, rotates it, and revokes it. For what a token can reach and why it never expires, read the Tokens concept.

Before you start 🔗

You need the Create Token permission to create a token in the interface. Organization Admin and Provider Admin hold it by default. A user without it sees the create control disabled.
You need View Tokens to open the Tokens tab. Every default user role holds it.
Decide which consumer gets this token. Create one token per consumer so you can revoke one without breaking the others.

Create a token 🔗

Open the Tokens tab under Security and start a new token. Enter a name and a purpose. Both are labels that appear in the token list: name the consumer (“ci-snapshots”), and state what it does in the purpose.

Review and Sign Out Sessions

Mon, 01 Jan 0001 00:00:00 +0000

Every sign-in to Layer5 Cloud creates a session, on every browser, device, and Meshery Server you use. This guide reviews your sessions and ends the ones you do not want. For how long sessions last and what a session can reach, read the Sessions concept.

Before you start 🔗

You need the View Sessions permission to open the Sessions tab. Every default user role holds it.
Ending another session from the tab requires the Delete Token permission, which Organization Admin and Provider Admin hold by default. Other roles see the Logout control disabled. This is how the interface works today.
You can end only your own sessions.

Review your sessions 🔗

Open the Sessions tab under Security. Each row is one sign-in and shows its ID, name, purpose, and creation date. Search filters by name or purpose, and the newest sessions appear first.

Build a Custom Keychain

Mon, 01 Jan 0001 00:00:00 +0000

A custom keychain bundles the keys that a custom role needs. This guide creates a keychain, changes its keys, and deletes it. It is written for Provider Admins and self-hosted operators, because only they can complete the whole path from keys to users. For the model, read the Keychains concept.

Before you start 🔗

You need the Create Keychain, Edit Keychain, and Delete Keychain permissions to use the matching controls. Provider Admin holds all three. No other default role does.
A keychain does nothing until a role includes it. Creating and editing roles is a Provider Admin action. On hosted Layer5 Cloud an organization cannot complete this path alone. On a self-hosted deployment, your Provider Admins can.
Keychains are not organization-scoped. A role that includes your keychain grants its keys to every user who holds that role, in every organization.

Create a keychain 🔗

Open the Keychains tab under Security and create a keychain. Give it a name and choose the keys it bundles. Layer5 Cloud creates the keychain and adds each key to it. If adding a key fails, the interface reports it as “Failed to add key to keychain”. Open the keychain and confirm every key you chose is present.