Sonarqube Authentication

generated: '2026-11-05'
method: searched
source:
- https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api.md
- https://docs.sonarsource.com/sonarqube-server/user-guide/managing-tokens.md
- https://docs.sonarsource.com/sonarqube-server/instance-administration/security/administering-tokens.md
- openapi/sonarqube-issues-api-openapi.yml
- openapi/sonarqube-measures-api-openapi.yml
- openapi/sonarqube-projects-api-openapi.yml
- openapi/sonarqube-quality-gates-api-openapi.yml
- openapi/sonarqube-rules-api-openapi.yml
- openapi/sonarqube-system-api-openapi.yml
- openapi/sonarqube-users-api-openapi.yml
summary:
  types:
  - http
  - apiKey
  recommended: bearer
  detail: '"To authenticate to the Web API, we recommend that you use the bearer authentication scheme." Basic auth
    with the token as username and an empty password is also accepted; the X-Sonar-Passcode header authenticates
    monitoring endpoints such as api/monitoring/metrics with the system passcode.'
schemes:
- name: basicAuth
  type: http
  scheme: basic
  description: HTTP basic authentication with the token as the username and an empty password ("pass the token using
    the bearer or basic HTTP authentication scheme").
  sources:
  - openapi/sonarqube-issues-api-openapi.yml
  - openapi/sonarqube-measures-api-openapi.yml
  - openapi/sonarqube-projects-api-openapi.yml
  - openapi/sonarqube-quality-gates-api-openapi.yml
  - openapi/sonarqube-rules-api-openapi.yml
  - openapi/sonarqube-system-api-openapi.yml
  - openapi/sonarqube-users-api-openapi.yml
- name: bearerAuth
  type: http
  scheme: bearer
  description: 'Bearer authentication with a SonarQube token: Authorization: Bearer <myToken>. Recommended scheme.
    Responses to token-authenticated calls carry a SonarQube-Authentication-Token-Expiration header with the token
    expiry date.'
  sources:
  - openapi/sonarqube-issues-api-openapi.yml
  - openapi/sonarqube-measures-api-openapi.yml
  - openapi/sonarqube-projects-api-openapi.yml
  - openapi/sonarqube-quality-gates-api-openapi.yml
  - openapi/sonarqube-rules-api-openapi.yml
  - openapi/sonarqube-system-api-openapi.yml
  - openapi/sonarqube-users-api-openapi.yml
  token_types:
  - type: User
    use: any Web API action the user may perform in the UI; required for SonarQube for IDE connected mode and the
      SonarQube CLI
  - type: Project analysis
    use: run analyses on one project and call web services requiring Execute Analysis on it
  - type: Global analysis
    use: run analyses on every project
  expiry: Optional expiration at creation (or No expiration unless an administrator enforces a maximum lifetime,
    Enterprise Edition and above); email reminder 7 days before expiry; expired tokens stop working but remain listed
    for revocation.
  docs: https://docs.sonarsource.com/sonarqube-server/user-guide/managing-tokens/
- name: systemPasscode
  type: apiKey
  in: header
  parameter: X-Sonar-Passcode
  description: System passcode defined by sonar.web.systemPasscode in sonar.properties or the SONAR_WEB_SYSTEMPASSCODE
    environment variable; "If you cannot use the bearer authentication scheme (e.g., with the API endpoint monitoring/metrics),
    you can use the X-Sonar-Passcode authentication scheme."
  sources:
  - https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api.md
docs: https://docs.sonarsource.com/sonarqube-server/extension-guide/web-api/#authenticate-to-api
notes:
- Administrative web services require specific permissions; a user token carries all permissions of its issuing
  user.
- OAuth is used only by the Sonar-hosted MCP service (mcp:tools:read / mcp:tools:write); the Web API itself has
  no OAuth client flow. See mcp/sonarqube-mcp.yml.
- Deactivating a user revokes all of that user's tokens.