API token management in Jenkins - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Jenkins CLI: List API Tokens for a User

You run the following Jenkins CLI command to list API tokens for user 'alice'. What is the expected output?

Jenkins

java -jar jenkins-cli.jar -s http://jenkins.example.com/ who-am-i --username alice --password secret

A

Authenticated as alice
User ID: alice
API Tokens:
- token1
- token2

B

Authenticated as alice
No API tokens found

C Error: Missing command 'list-api-tokens'

D Authentication failed: Invalid credentials

💡 Hint

The command 'who-am-i' shows user identity, not API tokens.

The 'who-am-i' command only confirms authentication and user identity. It does not list API tokens. If credentials are wrong, authentication fails.

🧠 Conceptual

intermediate

Purpose of Jenkins API Tokens

What is the main purpose of using API tokens in Jenkins instead of user passwords?

A To enable secure authentication for scripts and tools without exposing user passwords

B To allow users to reset their passwords automatically

C To encrypt all Jenkins data at rest

D To provide multi-factor authentication for Jenkins login

💡 Hint

Think about automation and security.

API tokens let scripts and external tools authenticate securely without using the user's actual password, reducing risk if the token is compromised.

❓ Troubleshoot

advanced

Troubleshooting Jenkins API Token Revocation

After revoking an API token for user 'bob', his automation scripts still authenticate successfully. What is the most likely reason?

A The token was regenerated with the same value

B The token was not actually revoked due to a UI caching issue

C The scripts are using a cached session cookie instead of the token

D Jenkins does not support token revocation

💡 Hint

Consider how authentication sessions work.

Jenkins sessions may remain active after token revocation, so scripts using cached session cookies can still authenticate until the session expires or is invalidated.

🔀 Workflow

advanced

Securely Creating and Using Jenkins API Tokens

Which sequence correctly describes the secure workflow to create and use a Jenkins API token for automation?

A 3,1,2,4

B 2,1,3,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Follow the logical order of accessing UI and generating tokens.

You must first log in, then go to your user profile to generate the token, then use it in scripts.

✅ Best Practice

expert

Best Practice for Managing Jenkins API Tokens in CI/CD Pipelines

What is the best practice for managing Jenkins API tokens securely in CI/CD pipeline configurations?

A Store the API token in Jenkins Credentials plugin and reference it securely in the pipeline

B Use the user's password instead of API tokens to avoid token expiration issues

C Share the API token via email with all team members for backup

D Hardcode the API token directly in the pipeline script for easy access

💡 Hint

Think about secure storage and access control.

Using Jenkins Credentials plugin keeps tokens encrypted and access controlled, avoiding exposure in scripts or logs.

Practice

1. What is the main purpose of an API token in Jenkins?

easy

A. To allow secure access to Jenkins without using your password

B. To reset your Jenkins user password automatically

C. To create new Jenkins user accounts

D. To monitor Jenkins server performance

Solution

1. Step 1: Understand API token function

   An API token acts like a password substitute for accessing Jenkins securely.

2. Step 2: Compare options

   Only To allow secure access to Jenkins without using your password correctly describes the token's purpose; others describe unrelated functions.

3. Final Answer:

   To allow secure access to Jenkins without using your password -> Option A

4. Quick Check:

   API token = secure password substitute [OK]

Hint: API tokens replace passwords for safe Jenkins access [OK]

Common Mistakes:

• Thinking tokens reset passwords
• Confusing tokens with user creation
• Assuming tokens monitor performance

2. Which Jenkins menu path lets you create a new API token?

easy

A. Manage Jenkins > Configure System

B. Dashboard > New Item

C. User Profile > Configure > API Token

D. Manage Plugins > Available

Solution

1. Step 1: Locate API token creation

   API tokens are created in the user's own profile settings, not global or plugin menus.

2. Step 2: Match correct menu path

   Only User Profile > Configure > API Token correctly points to User Profile > Configure > API Token.

3. Final Answer:

   User Profile > Configure > API Token -> Option C

4. Quick Check:

   API tokens created in user profile [OK]

Hint: API tokens are in your user profile settings [OK]

Common Mistakes:

• Looking under Manage Jenkins instead of user profile
• Confusing plugin menus with token creation
• Trying to create tokens from dashboard

3. What will happen if you use an invalid API token in a Jenkins REST API call?

medium

A. The API call succeeds but with limited permissions

B. The API call fails with an authentication error

C. The API call triggers a password reset

D. The API call is queued for later processing

Solution

1. Step 1: Understand token validation

   Jenkins checks API tokens for validity before allowing access.

2. Step 2: Identify failure behavior

   Invalid tokens cause authentication failure, so the call is rejected.

3. Final Answer:

   The API call fails with an authentication error -> Option B

4. Quick Check:

   Invalid token = authentication error [OK]

Hint: Invalid tokens cause authentication errors [OK]

Common Mistakes:

• Assuming calls succeed with limited access
• Thinking invalid tokens reset passwords
• Believing calls queue instead of failing

4. You created an API token but Jenkins shows 'Invalid token' error when using it. What is the most likely cause?

medium

A. You copied the token incorrectly or partially

B. You used the token in the Jenkins UI instead of API calls

C. You created the token in the wrong Jenkins instance

D. You forgot to restart Jenkins after creating the token

Solution

1. Step 1: Check token usage errors

   Common error is copying the token incorrectly, causing invalid token errors.

2. Step 2: Evaluate other options

   Tokens work immediately without restart; UI usage is different; wrong instance is less common.

3. Final Answer:

   You copied the token incorrectly or partially -> Option A

4. Quick Check:

   Copy error = invalid token [OK]

Hint: Always copy API tokens fully and exactly [OK]

Common Mistakes:

• Restarting Jenkins unnecessarily
• Using tokens in UI login fields
• Ignoring token instance mismatch

5. You want to revoke an old API token without affecting other tokens. How do you do this safely in Jenkins?

hard

A. Disable your Jenkins user account temporarily

B. Change your Jenkins user password to invalidate all tokens

C. Restart Jenkins to clear all active tokens

D. Delete the specific token from your user profile's API token list

Solution

1. Step 1: Understand token revocation

   Jenkins allows deleting individual API tokens from your user profile without affecting others.

2. Step 2: Compare other methods

   Changing password invalidates all tokens; restarting Jenkins or disabling account are not selective.

3. Final Answer:

   Delete the specific token from your user profile's API token list -> Option D

4. Quick Check:

   Delete token individually to revoke safely [OK]

Hint: Revoke tokens individually via user profile [OK]

Common Mistakes:

• Changing password to revoke one token
• Restarting Jenkins unnecessarily
• Disabling user instead of token