Create, revoke, or clear tokens

Ansible Automation Platform supports the following commands for OAuth2 token management:

create_oauth2_token
Copy link

Use the following command to create OAuth2 tokens (specify the username for example_user):

$ aap-gateway-manage create_oauth2_token --user example_user
                                                                                                                                                                                                                    
  New OAuth2 token for example_user: j89ia8OO79te6IAZ97L7E8bMgXCON2

Ensure that you give a valid user when creating tokens. Otherwise, an error message that you attempted to issue the command without specifying a user, or supplied a username that does not exist, is displayed.

revoke_oauth2_tokens
Copy link

Use this command to revoke OAuth2 tokens, both application tokens and personal access tokens (PAT). It revokes all application tokens (but not their associated refresh tokens), and revokes all personal access tokens. However, you can also specify a user for whom to revoke all tokens.

To revoke all existing OAuth2 tokens use the following command:

$ aap-gateway-manage revoke_oauth2_tokens

To revoke all OAuth2 tokens and their refresh tokens use the following command:

$ aap-gateway-manage revoke_oauth2_tokens --revoke_refresh

To revoke all OAuth2 tokens for the user with id=example_user (specify the username for example_user):

$ aap-gateway-manage revoke_oauth2_tokens --user example_user

To revoke all OAuth2 tokens and refresh token for the user with id=example_user:

$ aap-gateway-manage revoke_oauth2_tokens --user example_user --revoke_refresh

cleartokens
Copy link

Use the cleartokens command to delete all sessions that have expired.

For more information, see cleartokens in Django’s Oauth Toolkit documentation.

In Ansible Automation Platform 2.7, all user tokens are managed centrally through platform gateway. Clearing tokens removes access across all platform components.

clearsessions
Copy link

Use the cleartokens command to delete all sessions that have expired.

In Ansible Automation Platform 2.7, all user tokens are managed centrally through platform gateway. Clearing tokens removes access across all platform components.

For more information, see Clearing the session store in Django’s Oauth Toolkit documentation.

For more information about OAuth2 token management in the UI, see the Applications.

Personal Access Token migration
Copy link

After upgrading to Ansible Automation Platform 2.6, Personal Access Tokens (PATs) from a 2.4 automation controller remain functional. They are visible in the platform gateway UI and you can use them with both automation controller and platform gateway APIs.

Managing automation controller tokens

After the upgrade, you can perform the following actions with your automation controller tokens:

  • Platform gateway UI: You can edit or delete the tokens, but you cannot create or refresh them.
  • Automation controller API: You can create, edit, delete, or refresh the tokens.

Tokens are labeled in the UI to indicate if they are automation controller only or platform gateway. Platform gateway tokens are unaffected by these requirements, other than being rendered in the UI with a platform type.