Controlling user creation of tokens #5988

New Issue

adam · 2025-12-29T19:35:23+01:00

adam commented

2025-12-29 19:35:23 +01:00

Originally created by @candlerb on GitHub (Jan 23, 2022).

Originally assigned to: @jeremystretch on GitHub.

Change Type

Correction

Area

REST API

Proposed Changes

The documentation says:

The creation and modification of API tokens can be restricted per user by an administrator.

However it doesn't say how this is controlled, and I've been unable to find out how.

As admin, I created a completely unprivileged user ("Active" but no object permissions), and when logged in, it was able to create its own tokens.

I cannot see any setting at /admin/auth/user/<N>/change/ which would control this.

Looking at the source code, I can see nothing which prevents an individual user from creating their own token, as long as they are logged in:

    path('api-tokens/add/', views.TokenEditView.as_view(), name='token_add'),

class TokenEditView(LoginRequiredMixin, View):
...
    def post(self, request, pk=None):

        if pk:
            token = get_object_or_404(Token.objects.filter(user=request.user), pk=pk)
            form = TokenForm(request.POST, instance=token)
        else:
            token = Token(user=request.user)
            form = TokenForm(request.POST)

        if form.is_valid():
            token = form.save(commit=False)
            token.user = request.user
            token.save()

Therefore I propose either:

Update the documentation to say how the per-user restriction of token creation is actually done, if it's true; or
Remove this note if it's not true; or
Implement the functionality, if it's not currently implemented

Originally created by @candlerb on GitHub (Jan 23, 2022). Originally assigned to: @jeremystretch on GitHub. ### Change Type Correction ### Area REST API ### Proposed Changes The [documentation](https://netbox.readthedocs.io/en/stable/rest-api/authentication/#tokens) says: > The creation and modification of API tokens can be restricted per user by an administrator. However it doesn't say how this is controlled, and I've been unable to find out how. As admin, I created a completely unprivileged user ("Active" but no object permissions), and when logged in, it was able to create its own tokens. I cannot see any setting at `/admin/auth/user/<N>/change/` which would control this. Looking at the [source code](https://github.com/netbox-community/netbox/blob/v3.1.6/netbox/users/views.py#L214-L259), I can see nothing which prevents an individual user from creating their own token, as long as they are logged in: ``` path('api-tokens/add/', views.TokenEditView.as_view(), name='token_add'), ``` ``` class TokenEditView(LoginRequiredMixin, View): ... def post(self, request, pk=None): if pk: token = get_object_or_404(Token.objects.filter(user=request.user), pk=pk) form = TokenForm(request.POST, instance=token) else: token = Token(user=request.user) form = TokenForm(request.POST) if form.is_valid(): token = form.save(commit=False) token.user = request.user token.save() ``` Therefore I propose either: * Update the documentation to say how the per-user restriction of token creation is actually done, if it's true; or * Remove this note if it's not true; or * Implement the functionality, if it's not currently implemented

adam added the status: accepted type: documentation labels 2025-12-29 19:35:23 +01:00

adam closed this issue

2025-12-29 19:35:24 +01:00

adam commented

2025-12-29 19:35:24 +01:00

@github-actions[bot] commented on GitHub (Mar 25, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Mar 25, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#5988