Secrets, Tokens and Credentials in SonarQube

Mon, 01 Jan 0001 00:00:00 +0000

This document lists all secrets, tokens and credentials that can be configured and managed by an administrator user in SonarQube Server.

List of credentials

Credentials type	Usage	Official documentation link	Comment
Tokens
User tokens	Authenticate to SonarQube Web API	User Tokens	Provides traceability and reflects user permissions. Suitable for manual/API usage.
Project analysis tokens	Run analysis on a specific project	Project analysis tokens	Recommended for CI/CD. Limits access to a single project, reducing impact if compromised (least privilege).
Global analysis tokens	Run analysis on all projects	Global analysis tokens	Should not be used by default. Grants access to all projects and violates the principle of least privilege. Use only in exceptional cases where project-scoped tokens cannot be applied.
Other
User passwords	Local user authentication (fallback when SSO is not used)	Changing password	Cannot be fully disabled. Should not be used when SSO is enabled; access must be enforced via external Identity Provider.

Note

SonarQube does not support API Keys or SSH keys. Authentication is primarily handled through tokens and external identity providers.