Platform Tokens

Create tokens for a single database or all databases in a group using the CLI:

# Token for a single database
turso db tokens create <database-name>

# Token for all databases in a group
turso group tokens create <group-name>

You can control token scope, permissions, and expiration:

Flag	Description
-r, --read-only	Create a read-only token (queries only, no writes)
-p, --permissions	Set fine-grained permissions per table and action
-e, --expiration	Set token expiration (never, 7d, 30d, etc.)

Read-only token

turso db tokens create mydb --read-only

You can also create tokens using the Platform API.

Invalidating Tokens

You can invalidate all existing tokens for a database or group, which rotates the signing keys:

# Invalidate all tokens for a database
turso db tokens invalidate <database-name>

# Invalidate all tokens for a group (and all its databases)
turso group tokens invalidate <group-name>