Service User Tokens

Available: Service user tokens v1.265.0

Service user tokens is available from version 1.265.0.

Available: Service User Tokens v1.265

Service user tokens are available from LogScale v1.265.

A service user token is a named token that authenticates as a user. Like a personal API token, it inherits all the permissions of the user. If the user's permissions change, the token's permissions change too.

A user can hold only one personal API token, but many service user tokens. Creating a service user token does not replace the user's other tokens. Use service user tokens to give each integration or script its own token. You can then rotate or delete one token without affecting the others.

Service user tokens have the following properties:

  • Each token requires an expiry date. LogScale deletes the token automatically after it expires.

  • Each token name must be unique for the user. Names follow the same rules as other token names.

  • By default, a user can hold up to 20 unexpired service user tokens. To change this limit, set the MaxServiceUserTokensPerUser dynamic configuration.

  • The tokens follow the organization's personal API token security policy. This policy controls whether you can create the tokens and whether they have a forced expiry or IP filter. For more information, see Personal API token security policy.

  • LogScale deletes a user's service user tokens when it deletes the user.

To create a service user token, run the createServiceUserToken() GraphQL mutation. The following restrictions apply:

  • You cannot create a service user token while you authenticate with another service user token.

  • You can only create the token in your own organization, not while proxying into another organization. After you create it, you can use the token to proxy into other organizations you have access to.

To manage your service user tokens, use the following GraphQL operations:

The Audit Logging records the creation and deletion of each service user token. Creation entries include the token name. Requests made with a service user token show the actor type serviceUserToken.

Service user tokens do not change personal API tokens. The createPersonalUserToken() and createPersonalUserTokenV2() mutations, and the token field on viewer(), still work on the user's single personal API token.