Implementation:Bentoml BentoML CLI Api Token

Knowledge Sources	Bentoml_BentoML
Domains	CLI, Authentication
Last Updated	2026-02-13 15:00 GMT

Overview

Implements the bentoml api-token CLI command group for creating, listing, retrieving, and deleting API tokens on BentoCloud.

Description

The api_token.py module defines a Click command group named api-token that provides CRUD operations for BentoCloud API tokens via the CLI. It contains the following commands:

• list -- Lists all API tokens on BentoCloud. Supports a --search filter and three output formats: table (default), JSON, and YAML. The table format displays name, UID, creation date, expiration date, last used date, and scopes.

• create -- Creates a new API token with a given name, optional description, scopes, and expiration time. Scopes can be specified multiple times (e.g., --scope api --scope read_cluster). Expiration supports duration format (30d, 1w, 24h) and ISO date format (2024-12-31). The token value is prominently displayed in a Rich panel since it is only shown once.

• get -- Retrieves a specific API token by its UID. Displays detailed information including name, UID, description, timestamps, expiry status, scopes, and creator.

• delete -- Deletes an API token by its UID.

The module also includes a helper function _parse_expiration() that converts expiration strings into datetime objects, and _raise_api_token_error() that translates HTTP status codes (401 Unauthorized, 404 Not Found) into user-friendly error messages.

All commands use the BentoMLCommandGroup class from bentoml_cli.utils for consistent CLI behavior, and the rich library for formatted output.

Usage

Use these CLI commands to manage API tokens for authenticating with BentoCloud. Tokens are needed for programmatic access to BentoCloud APIs and resources.

Code Reference

Source Location

• Repository: Bentoml_BentoML
• File: src/bentoml_cli/api_token.py
• Lines: 1-311

Signature

@click.group(name="api-token", cls=BentoMLCommandGroup)
def api_token_command(): ...

@api_token_command.command(name="list")
@click.option("--search", ...)
@click.option("-o", "--output", type=click.Choice(["json", "yaml", "table"]), default="table")
def list_api_tokens(search: str | None, output: str) -> None: ...

@api_token_command.command(name="create")
@click.argument("name", ...)
@click.option("-d", "--description", ...)
@click.option("--scope", "-s", multiple=True, ...)
@click.option("--expires", ...)
@click.option("-o", "--output", ...)
def create_api_token(
    name: str,
    description: str | None,
    scope: tuple[str, ...],
    expires: str | None,
    output: str,
) -> None: ...

@api_token_command.command(name="get")
@click.argument("token_uid", ...)
@click.option("-o", "--output", ...)
def get_api_token(token_uid: str, output: str) -> None: ...

@api_token_command.command(name="delete")
@click.argument("token_uid", ...)
def delete_api_token(token_uid: str) -> None: ...

def _parse_expiration(expires_str: str | None) -> t.Any: ...
def _raise_api_token_error(err: BentoMLException, action: str) -> t.NoReturn: ...

Import

from bentoml_cli.api_token import api_token_command

I/O Contract

Inputs

Name	Type	Required	Description
name	str	Yes (create)	Name for the new API token
token_uid	str	Yes (get/delete)	UID of the API token to retrieve or delete
--search	str	No	Filter string for listing tokens by name
--scope / -s	str (multiple)	No	Scopes for the token: api, read_organization, write_organization, read_cluster, write_cluster
--expires	str	No	Expiration time as duration (30d, 1w, 24h) or ISO date (2024-12-31)
--description / -d	str	No	Description for the API token
-o / --output	Choice[json, yaml, table]	No	Output format (default: table)

Outputs

Name	Type	Description
table output	Rich Table	Formatted table of token information printed to stdout
json output	str	JSON-serialized token data printed to stdout
yaml output	str	YAML-serialized token data printed to stdout (syntax highlighted)
token value	Rich Panel	The created token value displayed in a prominent panel (create command only)

Usage Examples

# CLI: List all API tokens
# $ bentoml api-token list
# $ bentoml api-token list --search my-token -o json

# CLI: Create a new token with scopes and expiration
# $ bentoml api-token create my-token --scope api --scope read_cluster --expires 30d

# CLI: Get a specific token by UID
# $ bentoml api-token get abc123-uid

# CLI: Delete a token
# $ bentoml api-token delete abc123-uid

# Programmatic usage (registering the command group)
import click
from bentoml_cli.api_token import api_token_command

@click.group()
def cli():
    pass

cli.add_command(api_token_command)

Related Pages

• Implementation:Bentoml_BentoML_CLI_Secret
• Implementation:Bentoml_BentoML_CLI_Utils