--- schema_version: "1" id: ff0022395882f5deb7add338d704a389b41ad128d9af6c3b3e262c6a1662255d title: Unified Access Tokens collection: tableau version: next locale: en-us portal_url: https://docs.salesforce.com/tableau/next/en-us/api/cloud-manager/docs/unified_access_tokens.md canonical_url: https://help.tableau.com/v0.0/api/cloud-manager/en-us/docs/unified_access_tokens.html source_site: help.tableau.com content_type: documentation content_hash: 566e242418e58f105fd4427010f367facda46ba45ffcece65e774d247f5e3eb7 description: Documentation for the Tableau Cloud Manager --- # Unified Access Tokens Unified access tokens are configurations that enable JSON Web Token (JWT)-based authentication for both Tableau Cloud Manager (TCM) REST API and Tableau REST API. Starting in December 2025, UATs provide an enterprise-level token solution for managing Tableau Cloud at scale. #### Benefits of UATs UATs offer the following benefits: - **Unified authentication:** UATs enable JWT-based authentication for cloud administrators with the TCM REST API; and for users with both the TCM REST API and Tableau REST API. - **Concurrent sessions:** UATs support multiple concurrent sessions. - **Least privileged access:** Using access scopes, the JWT that is passed during sign-in and can offer the minimum permissions required to perform a task. - **Centralized control and management of tokens:** Through centralization of sites under a tenant, cloud administrators gain control over the management and revocation of UATs. - **Improved auditing:** You can see logs associated with a UAT to monitor activity, investigate issues, and meet compliance requirements. **Note:** JWT authentication using UATs and JWT authentication using Tableau connected apps are distinct authentication and authorization capabilities. Tableau connected apps are not supported in TCM. #### UATs with Tableau Bridge Starting in February 2026, you can use UATs to authenticate Tableau Bridge (on Linux) to Tableau Cloud. This enables secure, JWT-based authentication for Bridge connections, allowing you to manage Bridge authentication alongside your other Tableau Cloud access management workflows. Using UATs with Tableau Bridge provides the same benefits as using UATs with the TCM and Tableau REST APIs, including least-privileged access through scopes, centralized token management, and improved auditing capabilities for Bridge connections. When configuring the UAT, ensure the `scope` or `scp` claim specifies the following: - `tableau:remote_agents:*` - `tableau:jobs:read` - `tableau:file_uploads:*` - `tableau:datasources:*` For more information about configuring Tableau Bridge to use UATs, see [Step 4: Run the Bridge container](https://help.tableau.com/current/online/en-us/to_bridge_linux_install.htm#step-4-run-the-bridge-container) in the Tableau Cloud Help. **Table of Contents** ### About least privileged access and access scopes Using UATs, you can access both the TCM REST API and Tableau REST API. Access to these APIs are enabled by a JSON Web Token (JWT) as part of the initial sign in request. To enable least-privileged access, the JWT must contain **access scopes** that define the API methods that are available to the UAT. You can also specify a subset of those scopes in the UAT configuration itself to further restrict the access available to the JWT. #### Access scopes Scopes for UATs grant access to TCM REST API and Tableau REST API capabilities. Scopes are declared in the JWT (or in both the JWT and UAT configuration). A scope is a colon-separated string with the following format: `tableau::`. The scope starts with the Tableau namespace, `tableau`, followed by the resource, such as `tcm_sites` or `sites`, and ends with an action allowed on the resource, such as `read`. You can find the required scope for a JWT-supported method in its properties block in the [TCM REST API](https://help.tableau.com/current/api/cloud-manager/en-us/reference/index.htm) Help and [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm) Help. If a scope is not listed in the method’s properties block, access to that method can’t be controlled by a JWT. **Note:** Access scopes listed in the Tableau REST API are shared and also used to grant access to REST API capabilities using Tableau connected apps. **Examples:** - A scope that allows you to call the [Get site](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/Site-Methods/operation/getSite) method in the TCM REST API is `tableau:tcm_sites:read`. - A scope that allows you to call the [Query site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#query_site) method in the Tableau REST API is `tableau:sites:read`. #### Wildcard access scopes Instead of using the named access scope, you can replace the action in the scope string with the wildcard character (\*). Doing this can enable multiple supported actions for the given resource. **Examples:** - A wildcard scope that allows you to call certain [Users Methods](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/User-Methods) in the TCM REST API is `tableau:tcm_users:*`. - A wildcard scope that allows you to call get/list, add, delete, and update users methods in [Users and Groups Methods](https://help.tableau.com/current/api/rest_api) in the Tableau REST API is `tableau:users:*`. ## JWT authentication using unified access tokens This section outlines the required steps for authenticating with both the TCM REST API and Tableau REST API using unified access tokens (UAT) JWT. **Prerequisite - obtain a signing keypair**: Generate an RSA keypair or use an existing identity provider (IdP) that exposes a public key via JWKS. 1. **Sign in to TCM REST API**: Start an initial session to configure the UAT (using a personal access token). 2. **Create a UAT configuration**: Use the TCM REST API to create a UAT configuration, providing the JWKS URI or public key, from your IdP or keypair respectively. 3. **Generate and sign a JWT**: Create a JWT with the required claims and sign it with your private key. 4. **Sign in with the UAT JWT**: Make a sign-in request to either the TCM REST API or Tableau REST API using the signed JWT. 5. **Use the credentials token in subsequent requests**: Use the returned credentials token in the header of all subsequent API requests. ### Prerequisite: Obtain a signing keypair Before you can create a unified access token (UAT) configuration, you must have a signing keypair (private key + public key). The public key will be registered in the UAT configuration, and the private key will be used to sign JWTs during authentication. This enables cloud administrators to interact with the tenant and its resources; and users to interact with the site and its resources. - **Recommended option - use an existing identity provider:** We recommend you use your IdP such as Okta, Auth0, or another OIDC-compliant provider. Most IdPs already expose a JWKS (JSON Web Key Set) endpoint that serves public keys. This approach provides automatic key rotation and centralized key management. When creating the UAT configuration, you’ll provide the `jwksUri` that points to your IdP’s JWKS endpoint. - **Alternative option - generate your own RSA keypair:** If you don’t have an existing IdP or prefer to manage your own keys, you can generate an RSA keypair (RS256 algorithm recommended). When creating the UAT configuration, you’ll provide the `publicKey` inline. **Important:** This approach requires manual key rotation. ### Step 1: Sign in to Tableau Cloud Manager REST API To create your first unified access token (UAT) configuration, you must authenticate to the Tableau Cloud Manager (TCM) REST API. This initial authentication can’t be done with a UAT. - **First time workflow:** If authenticating to the TCM REST API for the first time, follow the steps described in [Sign in to Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html#sign-in-to-tableau-cloud-manager-rest-api). - **Returning workflow:** If you’ve previously signed in to the TCM REST API, authenticate using the [Sign in with personal access token](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/personalAccessTokenLogin) method. ### Step 2: Create a unified access token configuration Use the [Create unified access token configuration](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/createUatConfiguration) method to configure a UAT in the TCM REST API. This step registers the JWKS URI or public key that Tableau will use to verify JWTs signed with your private key. #### Example URI `POST https://cloudmanager.tableau.com/api/v1/uat-configurations` #### Example request body The request body must contain the following: - **Issuer:** The `issuer` value that will be matched against the `iss` claim in your JWTs. - **JWKS URI or public key:** - **Recommended option:** `jwksUri` pointing to your IdP’s JWKS endpoint (e.g., `https://myidp.okta.com/.well-known/jwks.json`) - **Alternative option:** `publicKey` containing the public key portion of your RSA keypair in PEM format - **Resource IDs:** An array of IDs. This can include the tenant ID, the tenant ID and the site IDs associated with the tenant, or one or more site IDs on the same tenant. **Note:** Specifying the tenant ID alone does not enable the UAT for all sites in the tenant. You must specify the site ID for each site you want to enable. **Example with JWKS URI (recommended)** ``` { "name": "UAT for FTE Admins", "issuer": "https://myidp.okta.com", "jwksUri": "https://myidp.okta.com/.well-known/jwks.json", "usernameClaim": "email", "resourceIds": [ "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], "scopes": [ "tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update" ], "enabled": true } ``` **Example with public key (alternative)** ``` { "name": "UAT for FTE Admins", "issuer": "https://myidp.okta.com", "publicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7...\n-----END PUBLIC KEY-----", "usernameClaim": "email", "resourceIds": [ "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], "scopes": [ "tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update" ], "enabled": true } ``` #### Example response body The request produces the following response body. ``` { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", "configId": "46ff6d11-d8b2-40d8-9197-dfa33c61cd6c", "name": "UAT for FTE Admins", "issuer": "https://myidp.okta.com", "publicKeyActive": "...", "publicKey": "...", "jwksUri": "https://myidp.okta.com/keys", "usernameClaim": "email", "resourceIds": [ "497f6eca-6276-4993-bfeb-53cbbbba6f08" ], "scopes": [ "tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update" ] "enabled": true } ``` ### Step 3: Generate and sign a JWT After the UAT configuration is created, you generate a JWT with the required claims and sign it with your private key. How you generate and sign the JWT depends on the option you chose in the prerequisite: - **Using an identity provider (IdP):** Your IdP typically generates and signs the JWT for you through its token endpoint or SDK, so you don’t handle the private key directly. Include a `kid` header that matches a key ID published in your IdP’s JWKS so Tableau can select the correct public key to verify the signature. - **Using your own RSA keypair:** You build the JWT and sign it yourself with the private key portion of your keypair, as shown in the example below. Tableau verifies the signature using the inline `publicKey` you provided in the UAT configuration. The JWT has required and optional claims. **Required claims** | Claim | Name | Description | | --- | --- | --- | | `alg` | Algorithm | (In header) JWT signing algorithm. For example, RS256. | | `iss` | Issuer | Unique issuer URI. Must match the `issuer` in the UAT configuration. | | `exp` | Expiration time | Expiration time in seconds from Epoch (Unix epoch time). | | `https://tableau.com/tenantId` | Tenant ID | Unique identifier of the tenant. Must match a resource ID in the UAT configuration. | | `iat` | Issue at | JWT creation time in seconds from Epoch (Unix epoch time). | | `` | Username | Username claim that maps to the Tableau user. For tenant, the user must map to the TCM user. For site, the user must map to the Tableau Cloud site user. If the claim is not specified, `email` is used as default. | **Optional claims** | Claim | Name | Description | | --- | --- | --- | | `kid` | Secret ID | (In header, if supplied by the Idp) Secret key identifier. Required if `jwksUri` is used in the UAT configuration. | | `typ` | Type | (In header, if supplied by the IdP) Type of JWT. Value must be `jwt`. | | `jti` | JWT ID | Required for JWT revoke capabilities. | | `scp`, `scope` | Scope | Access scopes. Defines the allowed operations. If using “scp”, values must be an array of strings. If using “scope”, values must be space delimited strings. | | `https://tableau.com/issuerOverride` | Issuer override | Enables a UAT configuration to use the same `tenantId` and `iss` combination. If used, the `iss` value in the second UAT configuration must be set to `https://tableau.com/issuerOverride`. | | `https://tableau.com/siteId` | Site ID | (Site-specific) Unique identifier of the site. Enables the UAT for the specified site only. Any other resource IDs specified in the UAT configuration will be ignored. | | `sub` | Subject | (Site-specific) User name (in email address format) that maps to the Tableau Cloud site user in embedding workflows. | | `https://tableau.com/oda` | On-demand access - capability | (Site-specific) Enables on-demand access in embedding workflows. Value must be `true`. | | `https://tableau.com/groups` | On-demand access - groups | (Site-specific) Name of one or more groups where access permissions are enabled for on-demand access. | | `https://tableau.com/groups` | Dynamic group membership | (Site-specific) Name of one or more groups on the Tableau Cloud site enabled for dynamic group membership. | | `` | (User attribute values) | (Site-specific) Enables user attributes in user attribute functions (UAF) in embedding workflows. | #### Example JWT Here is an example JWT in Python that demonstrates required and optional claims. The Python example uses the PyJWT library to sign the JWT with the private key from your keypair. ``` import jwt import datetime # Private key used to sign the JWT. The corresponding public key is referenced by the UAT configuration, either the JWKS endpoint (jwksUri) or inline (publicKey). private_key = """-----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7... -----END PRIVATE KEY-----""" payload = { "iss": "https://myidp.okta.com", "exp": 1788384855, "https://tableau.com/tenantId": "f97df110-f4de-492e-8849-4a6af68026b0", "iat": 1756848855, "jti": "https://myidp.okta.com:1756848855123", "username": "user@myidp.com", "scp": ["tableau:tcm_sites:read", "tableau:tcm_sites:update", "tableau:sites:read", "tableau:sites:update"], "https://tableau.com/oda": "true", "https://tableau.com/groups": ["Contractors", "Team C", "Group1", "Group2"], # Example groups "Region": "East" # Example user attribute } headers = { "kid": "kid", "typ": "JWT" } # Encode and sign the token with the private key token = jwt.encode( payload, key=private_key, alg="RS256", headers=headers ) ``` ### Step 4: Make a sign in request with unified access token JWT After the UAT is configured, you can use the JWT (generated in Step 3) to sign in to either the Tableau Cloud Manager (TCM) REST API or Tableau REST API. #### Sign in to TCM REST API Use the [Sign in with unified access token JWT](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/Authentication-Methods/operation/jwtLogin) method to generate a TCM credentials token. **Example URI** `POST https://cloudmanager.tableau.com/api/v1/jwt/login` **Example request body** The request body must contain the JWT (as the `token` value) associated with the UAT configuration you created in **Step 2**. ``` { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30" } ``` **Example response body** The request produces the following response body. The response includes the TCM credentials token, `sessionToken`. ``` { "sessionToken": "bSG+6ttrRgqMLzonp5j89w==:SUOF-rjwMZZKXg-T3GcpDVFrIKAO6VIbTyZyq39bWR0", "userId": "306982a2-4bb0-b858-b82eeI24b857", "tenantId": "56978815-59b6-4a61-b9e8-ede126e23bab", "sessionExpiration": "2025-0706T84:53:13.688541Z" } ``` #### Sign in to Tableau REST API You can use the same UAT configuration to sign in to the Tableau REST API using the [Sign in with JWT](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#jwt) method to generate a Tableau credentials token for Tableau Cloud. **Example URI** `POST https://mypod.online.tableau.com/api/3.27/auth/signin` **Note:** The URI requires you to include the Tableau Cloud pod name, such as prod-ca-a, eu-west-1a, or pro-apsoutheast-a. If you don’t know the pod name, see [About the pod name](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#pod) in the Tableau REST API Help. **Example request body** The request body must contain the following: 1. **JWT:** JSON Web Token (JWT) associated with the UAT configuration you created in **Step 2**. 2. **`isUAT`:** Must be set to `true`. This attribute is required to sign in with UAT JWT. Ignore this attribute to sign in with a Tableau connected apps JWT. 3. **`contentUrl`:** A required attribute for Tableau Cloud sign-in. For more information, see [About the Site Attribute](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#about-the-site-attribute) in the Tableau REST API Help. ``` { "credentials": { "jwt": "eyJpc3MiOiI1NmUwZGZhYi0zNDA3LTRlNWMtYWY5Ni04YzI1ZmY0NWI3ODMiLCJhbGciOiJIUzI1NiIsImtpZCI6ImJlNzFkNDc0LWMxOTctNDljNS04ZWIzLTM5YWU4MWVjNDNhYyJ9.eyJhdWQiOiJ0YWJsZWF1Iiwic3ViIjoidGVzdDEyMyIsInNjcCI6WyJ0YWJsZWF1OmNvbnRlbnQ6cmVhZCJdLCJpc3MiOiI1NmUwZGZhYi0zNDA3LTRlNWMtYWY5Ni04YzI1ZmY0NWI3ODMiLCJleHAiOjE2NDc2MjM1NzUsImp0aSI6ImY0MzdkNDFmLWM1MmMtNGE5Mi1hYTA1LWFjYTYyMGViZTgzMSJ9.pntsSpHmrxTT5XmiJi1Ls2qQdu4qMRQ5vgRuN7gtS_U", "isUat": true, "site": { "contentUrl": "" } } } ``` **Example response body** The request produces the following response body. The response includes the Tableau credentials token, `token`. ``` { "credentials": { "site": { "id": "9a8b7c6d5-e4f3-a2b1-c0d9-e8f7a6b5c4d", "contentUrl": "" }, "user": { "id": "9f9e9d9c-8b8a-8f8e-7d7c-7b7a6f6d6e6d" }, "token": "HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3" } } ``` ### Step 5: Include the session header in subsequent requests Use the credentials token you generated in **Step 4** to make subsequent requests. #### For Tableau Cloud Manager REST API Add the `sessionToken` to the `x-tableau-session-token` header for all subsequent TCM REST API requests. **Example header** `x-tableau-session-token:+iUzQx+s:E9T43sqund-xDGle-9trR7WPLkqCkT_7zks3_dVsV0By_Jji` The TCM credentials token is short-lived. It expires after 4 hours or when the session is idle for 30 continuous minutes with no requests. When the TCM credentials token expires, you need to sign in to Tableau Cloud Manager REST API again to get a new TCM credentials token. #### For Tableau REST API Add the `token` to the `X-Tableau-Auth` header for all subsequent Tableau REST API requests. **Example header** `X-Tableau-Auth:HvZMqFFfQQmOM4L-AZNIQA|5fI6T54OPK1Gn1p4w0RtHv6EkojWRTwq|a946d998-2ead-4894-bb50-1054a91dcab3` The Tableau credentials token is short-lived. It expires after 120 minutes (2 hours) or when the session is idle for 30 continuous minutes with no requests. When the Tableau credentials token expires, you need to sign in to Tableau REST API again to get a new Tableau credentials token. ## Monitor unified access token activity You can monitor unified access token (UAT) activity through the event log methods. The methods can retrieve up to 14 days of activity data or additional days of data if you have Enterprise or the Advanced Management add-on. ### Tenant-level monitoring You can use the **Get activity logs for tenant** and **List activity logs for tenant** to monitor UAT configuration changes and TCM REST API sign-in with a UAT JWT. For example, you can query the following event types (`eventType`) in the [List activity logs for tenant](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getActivityLogFileListForTenant) method: - `create_or_update_uat_configuration` - `delete_uat_configuration` - `create_uat_revocation` - `delete_uat_revocation` - `validate_uat_jwt` For more information about each event, see [Activity Log Tenant Event Type Reference](https://help.tableau.com/current/online/en-us/activity_log_tenant_schema.htm) in the Tableau Cloud Help. ### Site-level monitoring You can use the **Get activity logs for site** and **List activity logs for site** to monitor Tableau REST API sign-in with a UAT JWT. For example, you can query the following event type (`eventType`) using the [List activity logs for site](/v0.0/api/cloud-manager/en-us/reference/index.html#tag/Administrative-Methods/operation/getSiteActivityLogListForSite) method: - `login_with_jwt` For more information about the event, see [Activity Log Site Event Type Reference](https://help.tableau.com/current/online/en-us/activity_log_schema.htm) in the Tableau Cloud Help.