# Permission for creating OBO Token
**URL:** https://forum.opensearch.org/t/permission-for-creating-obo-token/25717
**Category:** Security
**Created:** [July 11, 2025, 4:52pm UTC](https://forum.opensearch.org/t/permission-for-creating-obo-token/25717 "2025-07-11T16:52:24Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@nelson](https://forum.opensearch.org/u/nelson)
#### Post date: [July 11, 2025, 4:52pm UTC](https://forum.opensearch.org/t/permission-for-creating-obo-token/25717/1 "2025-07-11T16:52:24Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch 3.0
Server OS - linux
running on k3s cluster
2 nodes (1 Master, 1 warm)
Cluster is green and works fine
Dashboard is healthy too
**Describe the issue** :
I am trying to set the right permission for creating OBO token by users. not sure what to use from the image below i can see this action security:obo/create but not sure what the permission will look like
**Configuration** :
**Relevant Logs or Screenshots** :
---
### Author:  [@pablo](https://forum.opensearch.org/u/pablo)
#### Post date: [July 15, 2025, 3:37pm UTC](https://forum.opensearch.org/t/permission-for-creating-obo-token/25717/2 "2025-07-15T15:37:34Z")
@nelson You need to add missing permission `security:obo/create` to the role’s cluster permissions.
The below role example has the minimal permissions to create OBO token.
```auto
pablo:
reserved: false
hidden: false
cluster_permissions:
- "cluster:admin/opensearch/ql/datasources/read"
- "indices:admin/template/get"
- "security:obo/create"
index_permissions:
- index_patterns:
- "*"
dls: ""
fls: []
masked_fields: []
allowed_actions:
- "indices:data/read/search"
- "indices:admin/mappings/get"
- "indices:admin/aliases/get"
tenant_permissions: []
static: false
```
