Hi team, is there anyway to generate PAT (Personal Access Token ) without having existing one in programatic way???

with the details of the user and the app's key, you can generate a token

oh thanks for help but i cant understand how to generate token based on user and app’s key can you give some example?

import jwt
payload = jwt.decode(token, token_secret, algorithms="HS256")

the default key, you can find in the repo as DATAHUB_TOKEN_SERVICE_SIGNING_KEY

thanks, so you mean if i generate token that way then i don’t have to generate token in web UI?

yes

ok so i decoded an token and found { “actorType”: “USER”, “actorId”: “datahub”, “type”: “PERSONAL”, “version”: “2", “exp”: 1663906090, “jti”: “3423208b-0e4c-40e1-a4ec-56b94d335b8b”, “sub”: “datahub”, “iss”: “datahub-metadata-service” } this payload and regenerated token with signing key but still get 401 Unauthorized so my question is do you store generated token and compare to incoming requests header token or just check it’s valid token??

Token string isn't stored when you generate in UI(that's why they always say to copy the token as it is not retrievable after you close the modal) . I believe it is more of checking that the token is valid

ok… then my question is if i generate key in UI then i get valid token and i can revoke the generated key and the key doesn’t work anymore what logic makes revoked key not to work anymore??

not sure about the revokable token, so cc @incalculable-ocean-74010

i found that my token info is stored at aspect = ‘dataHubAccessTokenInfo’ so i want to test generation of key based on payload and signingKey but now i can’t findout which is the signing key is signing key how can i interpret signing key syntax

${DATAHUB_TOKEN_SERVICE_SIGNING_KEY:WnEdIeTG/VVCLQqGwC/BAkqyY0k+H8NEAtWGejrBI94=}

combined with

systemClientSecret:
  secretRef: "datahub-auth-secrets"
  secretKey: "token_service_signing_key"
tokenService:
  signingKey:
    secretRef: "datahub-auth-secrets"
    secretKey: "token_service_signing_key"
  salt:
    secretRef: "datahub-auth-secrets"
    secretKey: "token_service_salt"

https://datahubspace.slack.com/archives/CV2UXSE9L/p1655435010041999?thread_ts=1655435010.041999&cid=CV2UXSE9L I asked devs before about the revokable tokens before

ok… i think i can set secret key

tokenService:
  signingKey:
    secretRef: "datahub-auth-secrets"
    secretKey: "my_secret_key"

i will test it and report here if anyone know right place to set sigining key then let me know