Using Personal Access Tokens to access Visual Studio Online

People who use Visual Studio Online for a while are probably familiar with the alternate credentials. These are used when accessing the REST API or when using an external client for accessing your Git repositories.

You configure your alternate credentials on your [My Profile] page and fill a username and password of your choice.

image

Once you enable your credentials, you can use these credentials when doing a REST call or (easier to test) clone a Git repository

image

This is great but not the most secure way of doing things.

Personal Access Tokens

In the update of July 7th, we now have the ability to use Personal Access Tokens as an alternative to the Alternate Credentials. Instead of sending our username and password over the wire we an now use a secure token that we can scope to a timeframe and to functionality within VSO. On the [My Profile] page you can configure one or more Personal Access Tokens. For example a token to access Code Features.

image

When you create the token, you see a token (only visible after creation !) that you should copy and keep safe.

image

This token alone is sufficient to authenticate against VSO. So when you now clone a Git repository you only have to fill in this token in the password box. Username can be empty or any value

image

The great thing is that you can revoke rights or the token afterwards and make sure that people cannot access stuff anymore.

Hope this helps!

Advertisements

22 Responses to “Using Personal Access Tokens to access Visual Studio Online”

  1. How do you actually use one of these things? Do I just send the personal access token as the value of the authorization header in the request? Does it have to be formatted some certain way? I’m using Casablanca for a command line tool and I can’t get it to authenticate using a personal access token against the REST APIs. This all seems to be too new to have much around the net about using it, this and one other blog post announcing it are all I found. Any docs that get into the specifics of the handshake?

  2. Is there a way to set the access token in a config so I don’t have to copy paste it?
    I know VSO is working on SSH support but in the meanwhile….
    Thx.

  3. Sorry for an irrelevant question! Which tool you used for drawing frame and curved line?

  4. Silly Question :- )
    But is this functionality also available in the normal “non-cloud version” of TFS 2015 ?

Trackbacks/Pingbacks

  1. Quick start on making an Apache Cordova app to connect to Visual Studio Online | Code Smells - September 14, 2015

    […] a Personal Access Token (PAT) to access Visual Studio Online through the app. Personal Access Tokens are a more secure way of […]

  2. Using JSON via REST to create build definitions in VSO | ALM by Erick Segaar - October 16, 2015

    […] also use the newly introduced personal access tokens (you can read more about that in this post of Rene van […]

  3. DevOps PHP Sample for Cory Fowler and his PHPWorld Presentation - Ozzie Rules Blogging - Site Home - MSDN Blogs - November 17, 2015

    […] Run tfx login. (requires PAT which can be created using these directions https://roadtoalm.com/2015/07/22/using-personal-access-tokens-to-access-visual-studio-online/) […]

  4. Scheduling Load Tests - Ozzie Rules Blogging - Site Home - MSDN Blogs - November 17, 2015

    […] https://roadtoalm.com/2015/07/22/using-personal-access-tokens-to-access-visual-studio-online/ […]

  5. Scheduling Load Test Execution - Microsoft Application Lifecycle Management - Site Home - MSDN Blogs - November 23, 2015

    […] https://roadtoalm.com/2015/07/22/using-personal-access-tokens-to-access-visual-studio-online/ […]

  6. Cloud Load Test Build Task information - Microsoft Application Lifecycle Management - Site Home - MSDN Blogs - December 11, 2015

    […] See <need link to service endpoint reference or point to this in the short term this https://roadtoalm.com/2015/07/22/using-personal-access-tokens-to-access-visual-studio-online/&gt; […]

  7. PHP Build Task from Cory Fowler’s DevOps PHPWorld Presentation - Microsoft Application Lifecycle Management - Site Home - MSDN Blogs - December 15, 2015

    […] Run tfx login. (requires PAT which can be created using these directions https://roadtoalm.com/2015/07/22/using-personal-access-tokens-to-access-visual-studio-online/) […]

  8. Call VSTS REST API from Release Management | The Road to ALM - June 8, 2016

    […] Instead of the variable you get out of the box, you need to create a Personal Access Token (PAT). I describe how to do that in this blogpost […]

  9. Controlling build quality using Build Tags and VSTS Release Management | The Road to ALM - July 8, 2016

    […] I also have a RestToken as a parameter. When we do not use the Release pipeline, we can just send a Personal Access Token to use this script from the command line as […]

  10. Programmatically promote your package quality with Release Views in VSTS | The Road to ALM - January 16, 2017

    […] First create a Personal Access Token (as described here ) […]

  11. Programmatically promote your package quality with Release Views in VSTS | Xebia Blog - February 11, 2017

    […] First create a Personal Access Token (as described here ) […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: