Platform Tokens

Create tokens for a single database or all databases in a group using the CLI:

# Token for a single database
turso db tokens create <database-name>

# Token for all databases in a group
turso group tokens create <group-name>

You can control token scope, permissions, and expiration:

Flag	Description
`-r`, `--read-only`	Create a read-only token (queries only, no writes)
`-p`, `--permissions`	Set fine-grained permissions per table and action
`-e`, `--expiration`	Set token expiration (`never`, `7d`, `30d`, etc.)

turso db tokens create mydb --read-only

turso db tokens create mydb --expiration 7d

turso db tokens create mydb \
  -p all:data_read \
  -p comments:data_add,data_update

turso db tokens create mydb \
  --read-only \
  --expiration 7d

You can also create tokens using the Platform API.

Invalidating Tokens

You can invalidate all existing tokens for a database or group, which rotates the signing keys:

# Invalidate all tokens for a database
turso db tokens invalidate <database-name>

# Invalidate all tokens for a group (and all its databases)
turso group tokens invalidate <group-name>

Overview External Auth Providers

​Invalidating Tokens

Invalidating Tokens