# \[URGENT\] Revoking all existing tokens in organization

**URL:** <https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671>\
**Category:** SonarQube Cloud\
**Tags:** tokens, sonarqube-cloud\
**Created:** [January 20, 2023, 9:02am UTC](https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671 "2023-01-20T09:02:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmtn](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@mmtn](https://community.sonarsource.com/u/mmtn)\
**Post date:** [January 20, 2023, 9:02am UTC](https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671/1 "2023-01-20T09:02:22Z")

</div>

Hi all;

Due to the recent CircleCI incident, we need to revoke all the existing tokens in our projects. However, as stated in this [topic](https://community.sonarsource.com/t/overview-of-sonar-tokens-used-by-users-of-the-organization/79779/16), there is no way to do this from our end either via user interface or web api because organizational admins do not have such previledge to perform this action. We have several users and even though we’ll request all of them to revoke their existing tokens, there is no mechanism to check if there are any existing tokens that are not revoked.

Since there is no help desk or ticketing system, my only option was to create a topic in this community forum. Please guide me to understand the process of how to request revoking of tokens in our organization. I am also not able to provide details about the organization or user accounts here. Hoping to see a response soon from sonarcloud admins as we need to solve this ASAP.

thank you in advance.

---

<div class="post-metadata">

**Author:** ![Serhat\_Yenican](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/serhat_yenican/32/34145_2.png) [@Serhat\_Yenican](https://community.sonarsource.com/u/Serhat_Yenican)\
**Post date:** [January 24, 2023, 12:53pm UTC](https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671/3 "2023-01-24T12:53:22Z")

</div>

Hi,

We’re aware of the [CircleCI breach](https://circleci.com/blog/january-4-2023-security-alert/) and the Sonar tokens you set there should be revoked.

After discussing with the team, we think that 2 options can be applied for this specific breach:

1. All users of your organization can revoke all their tokens through SonarCloud website or [Web API](https://sonarcloud.io/web_api/api/user_tokens).
2. The organization admin can remove the execute analysis permission from the users to find out users whose tokens are used in your CI after failing analysis. Then you can ask these users to revoke their tokens.

We are working on improving our token generation and managing processes. We will let you know of each update.

---

<div class="post-metadata">

**Author:** ![danielsgroves](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/danielsgroves/32/41497_2.png) [@danielsgroves](https://community.sonarsource.com/u/danielsgroves)\
**Post date:** [January 31, 2023, 1:26pm UTC](https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671/6 "2023-01-31T13:26:27Z")

</div>

I’ve tried revoking Execute Analyses for all of our users, but new updates using existing tokens are still working.

Is there anything else we should be trying, or does the permission change take time to kick in?

---

<div class="post-metadata">

**Author:** ![Serhat\_Yenican](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/serhat_yenican/32/34145_2.png) [@Serhat\_Yenican](https://community.sonarsource.com/u/Serhat_Yenican)\
**Post date:** [February 3, 2023, 12:34pm UTC](https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671/8 "2023-02-03T12:34:32Z")

</div>

Hi @danielsgroves

Permission changes work immediately. Although analysis can be triggered without any permission, there are two permissions requiring user authentication:

- ‘Browse’ permission is required to request the quality status. This permission is only required for private projects.
- ‘Execute Analysis’ permission is required to submit the analysis report.

Without ‘Execute Analysis’ permission, an analysis ends with this failure

> `Project not found. Please check the 'sonar.projectKey' and 'sonar.organization' properties, the 'SONAR_TOKEN' environment variable, or contact the project administrator`.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\
**Post date:** [February 14, 2023, 10:03am UTC](https://community.sonarsource.com/t/urgent-revoking-all-existing-tokens-in-organization/81671/10 "2023-02-14T10:03:48Z")

</div>

Closed on February 14, 2023, 10:03am UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.