Management tokens

A Management Token lets a CLI, CI pipeline, or infrastructure tool configure ReportPlane through the Management API. It is a personal control-plane credential tied to your workspace membership.

Create a token#

Open Settings → Management Tokens and select Create Management Token.

Choose:

• a name that identifies the automation;
• an expiration between 30 and 365 days;
• the smallest project set the automation needs;
• explicit read and write scopes.

Read-only tokens may be created by enabled workspace members. Any token containing a :write scope requires the creator to be a workspace owner or admin.

The secret starts with rp_mgmt_ and appears once. Copy the complete value into a secret manager before closing the dialog. ReportPlane stores only its hash.

Personal ownership#

A v1 Management Token acts with the access of the person who created it. Every request must pass both layers:

1. the token must allow the requested workspace, project, and scope;
2. the token owner must still be an enabled member with access to that resource.

Removing the owner's workspace or project access therefore stops the token. Workspace-owned service accounts are a separate future identity type; do not treat a personal Management Token as independent of its owner.

If a write-token owner is demoted below workspace admin, the token stops completely until its scopes or the owner's role are corrected.

Project access#

Choose individual projects for least privilege. All accessible projects means the token may follow the owner's current access across the selected workspace.

A project-restricted token cannot create a new project because the new ID is not yet in its allowlist. Project creation requires a workspace-wide token with projects:write.

Scopes#

Read and write scopes are independent. A write scope does not automatically grant its read counterpart.

Scope	Allows
projects:read	List and read projects
projects:write	Create and update projects
models:read	List and read data models
models:write	Create, update, and archive data models
warehouses:read	Read warehouses and masked credential metadata
warehouses:write	Create warehouses and create/update warehouse credentials
clients:read	Read ingest clients, query clients, and runtime API keys
clients:write	Create, configure, and revoke those runtime identities
analytics:read	Read Analytics APIs and bindings
analytics:write	Create, update, and archive Analytics APIs or create bindings
security:read	Read Client CA metadata
security:write	Create or delete Client CAs

Use the token#

Send the complete one-time secret as a Bearer token:

curl "https://app.reportplane.com/management/v1/models?project_id=PROJECT_ID" \
  --header "Authorization: Bearer $REPORTPLANE_MANAGEMENT_TOKEN"

Do not send a console session JWT or a runtime API Key to this endpoint.

Expiration and revocation#

Tokens expire automatically. Create a replacement, deploy it to the consumer, verify it, and then revoke the old token. Revocation is immediate and does not affect runtime API Keys.

The console shows the token prefix, expiration, last-use time, and last observed source IP. The secret itself cannot be recovered.