Docs / Console

Tokens and roles

lattice_live_ secrets, SHA-256 at rest, shown once. admin / operator / readonly.

Open Tokens (/tokens) as admin.

  1. Name the token (display only).
  2. Pick a role: admin, operator, or readonly.
  3. Create. Copy the secret immediately.

Stored as SHA-256. token_prefix is what you see later in the list. You cannot recover the full secret.

operator is helpdesk: reservations and force-release. Other writes 403. Operators cannot list tenants, DNS servers, or webhooks (secrets), and cannot mint tokens. readonly cannot mutate.

Token-create is rate-limited (10 / min / IP). Do not put the token in query strings or logs. Do not enable Access-Control-Allow-Origin: *. XSS on the Lattice origin can still read sessionStorage — treat the console host like a secret. The secret lives in this tab (memory + sessionStorage), not localStorage.

lattice-install already minted the first admin. Prefer /etc/lattice/bootstrap.token. Minting from curl only works on the server (loopback) while the table is empty:

curl -s -X POST http://127.0.0.1:8080/api/v1/tokens \
  -H 'content-type: application/json' \
  -d '{"name":"admin","role":"admin"}'