How to Tell What Kind of Pulumi Access Token You Have

Pulumi Cloud has three kinds of access tokens: personal tokens organization tokens team tokens All three kinds of tokens look similar and have the same format: pul- followed by 40 characters (at least according to Gitleaks and TruffleHog). So if you find a random token in something like an old CI pipeline, the token string itself doesn’t tell you where it’s from, what it can do, or who it belongs to. However, you can use the Pulumi CLI or API to get some useful information. tl;dr:Run pulumi whoami with the token using the PULUMI_ACCESS_TOKEN environment variable. A personal token returns a human username. Organization or team tokens return a service account: PULUMI_ACCESS_TOKEN="pul-..." pulumi whoami -vYou can also hit the Pulumi API directly if you don’t have the Pulumi CLI installed: curl -s -H "Authorization: token pul-..." https://api.pulumi.com/api/user And don’t worry, none of the access tokens in my examples are working tokens. Investigate a Token Using the Pulumi CLI The…