Grant a user access

This quick start will help you grant access to a user for your DataStax Astra DB database with ease.

Here are the basic steps:

Create your Astra DB account.
Create your organization.
Optional: Create a custom role with unique permissions.
Assign a role to a user.
Generate an application token.

If you are using a classic database that was created before 4 March 2021 and has not been migrated to the newest authentication, you cannot use application tokens for authentication. For more, see Authentication for classic databases.

Create your organization

Open your Astra Portal and click the Organizations dropdown.
Select the Organization dropdown and select Manage Organizations.
Select + Add Organization. The Add Organization window opens.
- Enter the name and email address for your new organization.
- Select Add to add the new organization.

The organization is added to the list. An email is sent to the email address entered for the organization owner.

Optional: Create a custom role with unique permissions

You don’t have to create custom roles to assign permissions to users. Custom permissions allow you to grant specific permissions to specific databases and keyspaces. For more, see Manage custom user roles and User permissions.

You can also create custom roles using the DevOps API.

In Astra Portal, select the organization in the left navigation to add a custom role.
Select Settings.
Select Role Management and then Add Custom Role.
Enter the name you want to use for your custom role. This name should help you easily identify when you want to assign this role to users.
Select the Organization, Keyspace, Table, and API permissions you want to assign to your custom role.

If you want users with this role to be able to see the Astra DB user interface, make sure you select Read User and View DB permissions.
To apply your selected permissions to specific databases or keyspaces, toggle the switch to not apply the permissions to all databases in an organization. Then select the specific databases or keyspaces to which you want to apply the permissions.
Once you have selected your permissions, select Create Role.

Assign a role to a user

From any page in Astra DB, select the Organizations dropdown.
In the main dropdown, select Organization Settings.
From the Users tab, select Invite User.
Enter the email address for the user you want to invite for the specific user role. If adding multiple users, separate the email addresses with commas, spaces, or line breaks.
Select the user role(s) for the user(s) you are inviting. Multiple roles are available within each group of roles for Organization Access, Database, Keyspace, or Table Access, and API Access.
Select Invite Users to send email invitations to the users at their email address.

Invited users are listed as pending until they accept the invitation to join your organization.

Generate an application token

You can also create an application token using the DevOps API.

From any page in Astra DB, select the Organizations dropdown.
In the main dropdown, select Organization Settings.
From your Organization page, select the Tokens tab.
Select the role you want to attach to your token. The permissions for your selected role will be displayed.
Select Generate Token. Astra DB will generate your token and display the Client ID, Client Secret, and Token.
Download your Client ID, Client Secret, and Token.

After you navigate away from the page, you won’t be able to download your Client ID, Client Secret, and Token again. These tokens do not automatically expire, but can be destroyed in case they are compromised or no longer needed.

What’s next?

You can now use your token to connect to the Astra DB APIs. See more about the available APIs:

You can use your Client ID and Client Secret to connect to your database. See more about the available connection options: