Users & Access

Overview

Manage your team’s access to Fly:

• Team Management - Add, remove, and manage team members
• Role Administration - Control permissions with Admin and Developer roles
• Token Management - Generate and revoke tokens for automation

Team Management

User Roles

JFrog Fly has two role types:

Admin Role

Full access to all JFrog Fly functionality:

Developer Role

Standard development access:

Viewing Team Members

Navigate to Team Management to see:

User Status

Active

• User has completed sign-up
• Can access Fly Registry
• Appears as option for @mentions and searches

Pending

• User has been invited but hasn’t signed up yet
• Invitation email sent
• Can resend invitation if needed

Inviting Users

Invite Flow (Admin Only)

1. Click Invite User button
2. Fill in user details:
   • Email Address (required)
   • Role - Choose Admin or Developer
3. Click Send Invitation
4. User receives email with a signup link

What the User Sees

The invited user receives an email containing:

• A welcome message
• An invitation from your team name
• A signup link

Managing Users

Updating User Roles (Admin Only)

Change a user’s role:

1. Navigate to Team Management
2. Click on the user you want to update
3. Select Change Role
4. Choose new role (Admin or Developer)
5. Confirm the change

Note: The system ensures at least one Admin always exists.

Removing Users (Admin Only)

Delete a user from the team:

1. Navigate to Team Management
2. Click on the user to remove
3. Select Delete User
4. Confirm deletion

Token Management

What Are Tokens?

Tokens are credentials that allow:

• Manual package manager configuration (without Desktop App)
• Connecting runtime environments (e.g., Kubernetes) to Fly Registry
• External system integration
• CI/CD workflows (though OIDC is preferred)
• Programmatic API access

Token Types

Read & Write Token

Full access to artifacts:

• Upload (publish) artifacts
• Download (pull) artifacts
• View artifact metadata
• Create releases (if uploading from external CI)

Use cases:

• Manual local development
• External CI/CD systems
• Automated deployment scripts

Read-Only Token

Limited access:

• Download (pull) artifacts only
• View artifact metadata only
• Cannot upload or modify

Use cases:

• Kubernetes clusters pulling images
• Deployment environments
• External consumers of your packages
• Sharing with partners/customers

Creating Tokens

Token Creation Flow

1. Click your user avatar (top-right) and select Token Management
2. Click Create Token
3. Configure token:
   • Name - Descriptive name (e.g., “k8s-production”)
   • Permission - Read & Write or Read-Only
   • Expiration - Date or “Never”
4. Click Create
5. Copy token immediately - Shown only once!

Token Configuration

• Name - Should be descriptive (e.g., “k8s-production”, “ci-pipeline”)
• Permission - Read-Only or Read & Write
• Expiration - Choose expiration time

Using Tokens

Token Value

After creation, the token value is shown once:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Critical: Copy and save immediately. If lost, you must create a new token and revoke the old one.

Manual Package Manager Configuration

Use tokens to manually configure package managers:

npm

Add to .npmrc:

registry=https://<your-fly-subdomain>.jfrog.io/artifactory/api/npm/npm/
//<your-fly-subdomain>.jfrog.io/artifactory/api/npm/npm/:_authToken=<your-fly-token>

pip

Add to pip.conf or use environment variable:

export PIP_INDEX_URL=https://<your-fly-username>:<your-fly-token>@<your-fly-subdomain>.jfrog.io/artifactory/api/pypi/pypi/simple

Docker

Login with token:

docker login <your-fly-subdomain>.jfrog.io/docker -u <your-fly-username> -p <your-fly-token>

See Package Managers for all package managers.

Managing Tokens

Viewing Tokens

Click your user avatar (top-right) and select Token Management to see:

Revoking Tokens

Immediately invalidate a token:

1. Click your user avatar (top-right) and select Token Management
2. Find the token to revoke
3. Click Revoke
4. Confirm revocation

Effects:

• Token immediately becomes invalid
• Any systems using the token lose access
• Token cannot be unrevoked
• Token is marked as “Revoked” in the list

Permissions:

• Admins can revoke any token
• Developers can only revoke their own tokens

Deleting Tokens

Remove token from the list:

1. Click your user avatar (top-right) and select Token Management
2. Find an Expired or Revoked token
3. Click Delete
4. Confirm deletion

Note: Can only delete non-active tokens.