API token management in Jenkins - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an API token in Jenkins?

An API token in Jenkins is a secret key used to authenticate API requests without using your password. It helps keep your account secure when accessing Jenkins programmatically.

beginner

How do you create a new API token in Jenkins?

Go to your Jenkins user profile, click on 'Configure', then find the 'API Token' section. Click 'Add new Token', give it a name, and Jenkins will generate a new token for you to copy and use.

beginner

Why should you avoid sharing your Jenkins API token?

Because the API token grants access to your Jenkins account and its permissions. Sharing it can let others perform actions on your behalf, risking security and data integrity.

intermediate

How can you revoke an API token in Jenkins?

In your Jenkins user profile under 'Configure', find the list of API tokens. Click the 'Revoke' button next to the token you want to disable. This stops the token from working immediately.

beginner

What is a practical use of Jenkins API tokens?

They are used to authenticate automated scripts or tools that interact with Jenkins, like triggering builds or fetching job status, without exposing your password.

Where do you find the option to create a new API token in Jenkins?

A In the Jenkins dashboard main page

B In the Jenkins system settings

C In the job configuration page

D In your user profile under 'Configure'

API tokens are managed in your user profile under the 'Configure' section.

What should you do if you suspect your Jenkins API token is compromised?

A Revoke the token immediately

B Change your Jenkins password only

C Ignore it if no suspicious activity is seen

D Create a new Jenkins user

Revoking the compromised token stops unauthorized access immediately.

Which of the following is NOT a reason to use API tokens instead of passwords in Jenkins automation?

A API tokens can be revoked without changing your password

B API tokens limit exposure of your main password

C API tokens are easier to remember than passwords

D API tokens allow secure programmatic access

API tokens are usually long and random, so they are not easier to remember than passwords.

How does Jenkins treat API tokens when authenticating API requests?

A As a substitute for your password

B As a username

C As a job parameter

D As a build trigger

API tokens act as a password substitute for API authentication.

What happens if you revoke an API token in Jenkins?

A The token remains active for 24 hours

B The token stops working immediately

C The token is deleted but still works

D The token is converted to a password

Revoking disables the token immediately to prevent further use.

Explain the steps to create and use an API token in Jenkins for automation.

Think about where you manage your Jenkins user settings.

Describe why managing API tokens carefully is important for Jenkins security.

Consider what could happen if someone else gets your token.