Can we turn off use created API Token creation but still use ones created by a service account?

[Christopher Johnston]

As the title explains, we want a chance to vet the API Tokens being used in our environment. As such, we want to update the authentication policy to turn off user created tokens. However, we have a service account that all of the admins have access to so that we can create on behalf of others (and thus vet the requests.)

The only option I see in the settings states "Determine whether members can access products with a user API token" Allow or Block.

Any insight into what happens when we choose Block? Does it just go away from the Account Settings / Security page for users? Or does it stop all API Tokens from working?

[Mikael Sandberg · Accepted solution]

You can do this by setting up a new Authentication policy and set it to allow API token access and add your service accounts as members of the policy. Once that is done change the default one to block API token access to prevent users from creating tokens.

[Christopher Johnston]

Brilliant. This does should do the trick.

[Matteo Vecchiato]

Hi @Christopher Johnston ,

The authentication policy applies to member selected inside it, the service account should not be involved in the users authentication policies.

Regards