DataHub Personal Access Tokens: Rotation, UI Indexing Lag, and Secure Header-Based Usage – DataHub Customer Support Portal

Area: Product Issues

Sub-Area: Personal Access Token (PAT) Management

Issue

Users attempting to rotate Personal Access Tokens (PATs) in the DataHub UI may encounter a brief warning message stating that token authentication is disabled, and may not see newly created tokens appear in the Access Tokens list immediately after generation. This can lead to confusion about whether the token was successfully created, whether token authentication is truly disabled on the tenant, and whether existing header-based API integrations are affected by MCP-related security changes introduced in v2.1.2.

Error Messages

Token based authentication is currently disabled. Contact your administrator.
PAT authorization is temporarily disabled. Contact your administrator.

You Might Be Asking

Why does the DataHub UI flash a warning saying PAT authentication is disabled when I try to create a new token?
I generated a new PAT but it does not appear in Settings → Access Tokens — was it actually saved?
Does the v2.1.2 MCP security fix affect my existing API calls to /gms, /openapi/v3/entity, or /api/graphql when I pass the token in the Authorization header?
How do I safely rotate a PAT in DataHub?
Can I use OAuth instead of a PAT for automated pipeline integrations?

Solution

1. Understanding the Flash Warning ("Token authentication is currently disabled")

This message is a known UI loading artifact and does not reflect your tenant's actual configuration. The DataHub frontend initializes the tokenAuthEnabled flag to false before the real server configuration is fetched from the backend. This causes a sub-second flash of the warning on page load. As soon as the application configuration loads (typically within one second), the flag updates to reflect the real value. If token authentication is genuinely enabled on your instance, the warning will disappear almost immediately and you can proceed with token creation normally.

This is not a product defect or an administrator-applied restriction. If the warning persists for more than a few seconds and does not resolve, contact your DataHub administrator or DataHub Support to confirm that METADATA_SERVICE_AUTH_ENABLED is set to true in your deployment configuration.

2. Why a Newly Created Token May Not Appear in the Access Tokens List

The Access Tokens list in Settings is powered by the DataHub search index. If the search index is running behind — which can occur on any deployment — newly created tokens may not appear in the list immediately after generation, even though the token was successfully created and is fully valid and usable. The token is stored in the backend the moment you click Generate, regardless of whether the list has refreshed.

After clicking Generate, copy the token secret from the dialog that appears immediately. The secret is shown only once and cannot be retrieved later.
If the list appears empty or does not show the new token, perform a hard page refresh:
- Windows/Linux: Ctrl + Shift + R
- macOS: Cmd + Shift + R
If the token still does not appear after a hard refresh, wait for the search index to catch up. The token is valid and usable in the meantime.

To confirm a token was successfully created before the index catches up, you can test it immediately by making an authenticated API call:

curl -H "Authorization: Bearer <your-new-token>" \
  https://<your-instance>.acryl.io/api/graphql \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"query": "{ me { corpUser { urn } } }"}'

A successful response confirms the token is valid.

3. Rotating a PAT Safely

Navigate to Settings → Access Tokens in the DataHub UI.
Click Generate new token, give it a descriptive name, and set an appropriate expiration.
Immediately copy the token secret from the confirmation dialog. It will not be shown again.
Update all integrations and configuration files that reference the old token with the new token value.
Verify each integration is working correctly with the new token.
Return to Settings → Access Tokens and revoke the old token. If index lag means the old token is not yet visible, wait for the index to catch up before revoking, or contact DataHub Support to assist with revocation.

If UI-based token creation consistently fails silently, verify that the user account performing the action has the required platform privilege. PAT creation requires either the Generate Personal Access Tokens or Manage Access Tokens platform privilege assigned via a DataHub Policy. To check:

Go to Settings → Policies.
Confirm the relevant user or group has the Generate Personal Access Tokens privilege.
If the privilege is missing, have an admin add it, then retry token creation.

As an alternative to the UI, you can also create a token via the GraphQL API using an existing valid token:

curl -X POST https://<your-instance>.acryl.io/api/graphql \
  -H "Authorization: Bearer <your-existing-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation createAccessToken($input: CreateAccessTokenInput!) { createAccessToken(input: $input) { accessToken } }",
    "variables": {
      "input": {
        "type": "PERSONAL",
        "actorUrn": "urn:li:corpuser:<your-username>",
        "duration": "ONE_MONTH",
        "name": "my-rotated-token"
      }
    }
  }'

Copy the returned accessToken value and store it securely, then revoke the old token.

4. Confirming Header-Based API Usage Is Unaffected by v2.1.2

The security fix introduced in DataHub v2.1.2 removed support for passing access tokens as URL query parameters (e.g., ?token=<value>) on the MCP (Model Context Protocol) endpoint. This change was scoped exclusively to the MCP route. It does not affect any of the following standard API endpoints when the token is passed in the Authorization: Bearer request header:

/gms
/openapi/v3/entity
/api/graphql

Integrations using header-based authentication on these endpoints are fully valid and were not impacted by the v2.1.2 changes. No reconfiguration of these integrations is required due to that fix. Token rotation on these endpoints remains a best-practice precaution if you believe a token may have been exposed through any other mechanism.

5. Choosing the Right Authentication Method for Automated Pipelines

The OAuth-based MCP authentication flow requires interactive browser sign-in and is intended for individual human users. It is not suitable for unattended or automated workloads such as pipeline orchestrators. For automated use cases:

Continue using a PAT passed via the Authorization: Bearer header.
For better isolation and auditability, consider using a Service Account instead of a personal user account. Service Accounts can be created under Settings → Users & Groups → Service Accounts and are designed for automated, non-human integrations.

Additional Notes

The UI loading artifact that causes the "token authentication is currently disabled" flash has been present across multiple DataHub frontend versions and is not introduced by any specific recent change. It is caused by the frontend's initial default value for tokenAuthEnabled being false before the server application config is fetched. Tokens that were created but whose secrets were not copied at generation time cannot be recovered — the secret is shown only once. In this case, generate a new token, copy the secret immediately, and revoke the inaccessible token once the search index catches up and it becomes visible in the list. DataHub's roadmap includes phasing out non-expiring tokens and improving token audit logging; it is recommended to always set an expiration when generating new PATs. The MCP URL query parameter authentication method has been fully removed as of v2.1.2 and cannot be re-enabled.