Skip to main content

User Tokens

This token store may be accessed with either Management API Client permissions or signed-in user account permissions, and tokens can be shared between applications and services by defining ACLs (see below).

Your Trivore ID instance's /apidoc lists the API endpoints under /user/{userId}/token.

Basics​

User tokens are access-controlled key-value pairs tied to a user account. A token's value can be any string, including escaped JSON, or a small file encoded as a base64 string.

User tokens can be queried by user ID, and a single token by user ID and key. As with other application-specific data persistence methods, Trivore ID never interprets a token's value itself — it's only meaningful to the external applications using it.

Since user tokens are access-controlled, they're a good place to store application-specific information about a user's roles and permissions. In that case, the token should only be readable and writable by the Management API Client responsible for resolving access.

Limitations​

  • The size limit for a single user token is 16 MB, including metadata. Keep in mind that many tokens with large values may eventually cause performance issues when querying a large number of them.
  • Once the user a token belongs to is deleted, its tokens may no longer be available. Make sure a user doesn't hold anything important in their tokens before permanently deleting their account.

Access control lists (ACLs)​

By default, a user token is private to the Management API Client that created it. Unlike that default, ACLs can be defined on a token to allow controlled sharing between applications.

Each token may have the following ACLs defined:

  1. Owner — set via PUT /api/rest/v1/user/{userId}/token:

    "owner": { "id": "string", "type": "USER" }

  2. Read-write — set via POST /api/rest/v1/user/{userId}/token/{key}/rw, as an array:

    [ { "id": "string", "type": "USER" } ]

  3. Read-only — set via POST /api/rest/v1/user/{userId}/token/{key}/ro, as an array:

    [ { "id": "string", "type": "USER" } ]

This is what allows controlled sharing of user data between external applications. The user token API is documented in the normal path at /apidoc.

Last updated on