kongctl provides for creating Konnect access tokens.
kongctl create konnect
Uses:
kongctl
Related Documentation
Incompatible with
on-prem
Related Resources
Command usage
Usage:
kongctl create konnect [flags]
kongctl create konnect [command]
Aliases:
konnect, k, K
Examples:
# Create a Konnect personal access token
kongctl create konnect pat --name ci --expires-in 30d -o token
# Create a Konnect system account access token
kongctl create konnect spat --system-account-name ci-bot --name ci --expires-in 30d -o env
Available Commands:
mesh Create Kong Mesh access tokens
organization Manage Konnect organization resources
pat Create a Konnect personal access token
spat Create a Konnect system account access token
Flags:
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 0_x_96_f, 12_bit_rainbow, 13_th_floor, 3024_day ]
- List : [ kongctl list themes ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
-h, --help help for konnect
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
Use "kongctl create konnect [command] --help" for more information about a command.
kongctl create konnect mesh
The mesh command works with resources on a Kong Mesh control plane.
Usage:
kongctl create konnect mesh [flags]
kongctl create konnect mesh [command]
Examples:
# Issue a token that proves a zone's identity to the global control plane
kongctl create mesh zone-token --zone zone1 --valid-for 720h --control-plane-id <id>
# Issue a token that proves a dataplane's identity
kongctl create mesh dataplane-token --mesh default --name backend-01 --control-plane-id <id>
# Mesh resources are written with apply, since a write creates or replaces
kongctl apply mesh -f policy.yaml --control-plane-id <id>
Available Commands:
dataplane-token Issue a token that proves a dataplane's identity
zone-token Issue a token that proves a zone's identity
Flags:
--all-meshes List mesh scoped resources across every mesh instead of one. Ignored for global types.
- Config path: [ konnect.mesh.all-meshes ]
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--ca-cert-file string Path to a CA certificate that verifies a self managed control plane.
- Config path: [ konnect.mesh.control-plane.ca-cert-file ]
--client-cert-file string Path to a client certificate presented to a self managed control plane.
- Config path: [ konnect.mesh.control-plane.client-cert-file ]
--client-key-file string Path to the key for --client-cert-file.
- Config path: [ konnect.mesh.control-plane.client-key-file ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 0_x_96_f, 12_bit_rainbow, 13_th_floor, 3024_day ]
- List : [ kongctl list themes ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--control-plane-id string ID of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.id ]
--control-plane-name string Name of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.name ]
--control-plane-token string Bearer token for a self managed control plane. Not used for a Konnect hosted one.
- Config path: [ konnect.mesh.control-plane.token ]
--control-plane-url string API URL of a self managed Kong Mesh control plane. Provide only one control plane selector flag.
- Config path: [ konnect.mesh.control-plane.url ]
-h, --help help for mesh
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
-m, --mesh string Mesh that mesh scoped resources belong to.
- Config path: [ konnect.mesh.mesh ] (default "default")
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
--tls-skip-verify Do not verify a self managed control plane's certificate. Prefer --ca-cert-file.
- Config path: [ konnect.mesh.control-plane.tls-skip-verify ]
Use "kongctl create konnect mesh [command] --help" for more information about a command.
kongctl create konnect organization
Manage Konnect system account resources.
Usage:
kongctl create konnect organization [flags]
kongctl create konnect organization [command]
Aliases:
organization, org, orgs
Available Commands:
system-account Manage Konnect system account resources
Flags:
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 0_x_96_f, 12_bit_rainbow, 13_th_floor, 3024_day ]
- List : [ kongctl list themes ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
-h, --help help for organization
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
Use "kongctl create konnect organization [command] --help" for more information about a command.
kongctl create konnect pat
Create a Konnect personal access token.
Usage:
kongctl create konnect pat [flags]
Aliases:
pat, pats
Examples:
kongctl create pat --name ci --expires-in 30d -o token
kongctl create pat --name ci --expires-in 7d --jq -r '.token'
Flags:
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 0_x_96_f, 12_bit_rainbow, 13_th_floor, 3024_day ]
- List : [ kongctl list themes ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--expires-at string Token expiration timestamp in RFC3339 format, for example 2026-06-24T12:00:00Z or 2026-06-24T12:00:00+02:00. Fractional seconds are accepted. Must be between 1 day and 365 days (12 months) from now.
--expires-in string Token lifetime. Use a duration between 1 day and 365 days (12 months). Supported units are ns, us, ms, s, m, h, and d (days). Examples: 24h, 36h, 1d, 30d.
-h, --help help for pat
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
--name string Token name
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text|token|env ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
--user-id string Konnect user ID. Defaults to the authenticated user.
kongctl create konnect spat
Create a Konnect system account access token.
Usage:
kongctl create konnect spat [flags]
Aliases:
spat, spats
Examples:
kongctl create spat --system-account-name ci-bot --name ci --expires-in 30d -o env
Flags:
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 0_x_96_f, 12_bit_rainbow, 13_th_floor, 3024_day ]
- List : [ kongctl list themes ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--expires-at string Token expiration timestamp in RFC3339 format, for example 2026-06-24T12:00:00Z or 2026-06-24T12:00:00+02:00. Fractional seconds are accepted. Must be between 1 day and 365 days (12 months) from now.
--expires-in string Token lifetime. Use a duration between 1 day and 365 days (12 months). Supported units are ns, us, ms, s, m, h, and d (days). Examples: 24h, 36h, 1d, 30d.
-h, --help help for spat
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
--name string Token name
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text|token|env ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--system-account-id string Konnect system account ID
--system-account-name string Konnect system account name
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]