From 6b80c838a4d6668f10dff8f3563ac71b0639bbe7 Mon Sep 17 00:00:00 2001 From: Lee Calcote Date: Mon, 19 Oct 2026 01:35:32 -0500 Subject: [PATCH] docs(tokens): approving a desktop app sign-in needs Create Token in any of your organizations Signed-off-by: Lee Calcote --- content/en/cloud/concepts/identity-and-security/tokens.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud/concepts/identity-and-security/tokens.md b/content/en/cloud/concepts/identity-and-security/tokens.md index 64c241b50a8..50e38972362 100644 --- a/content/en/cloud/concepts/identity-and-security/tokens.md +++ b/content/en/cloud/concepts/identity-and-security/tokens.md @@ -58,7 +58,7 @@ Each action on the Tokens tab is governed by a [key]({{< ref "cloud/concepts/ide Every token action applies only to your own tokens. You cannot list, download or delete another user's token. {{< alert type="warning" title="Current behavior: token create and delete requests are not checked against the keys" >}} -The Layer5 Cloud server allows any signed-in user to create and delete their own tokens through the API. It does not check the Create Token or Delete Token keys on those requests. Withholding those keys hides the controls in the interface; it does not prevent a user from minting a token. Approving a desktop app or CLI sign-in is different: the server requires Create Token in the selected organization. +The Layer5 Cloud server allows any signed-in user to create and delete their own tokens through the API. It does not check the Create Token or Delete Token keys on those requests. Withholding those keys hides the controls in the interface; it does not prevent a user from minting a token. Approving a desktop app or CLI sign-in is different: the server requires Create Token in at least one organization you belong to. The organization you have selected, or the one a custom domain belongs to, does not matter, so a member of a child organization can approve a sign-in on its parent's custom domain. {{< /alert >}} The [security reference]({{< ref "cloud/reference/security.md" >}}) lists every security key and the roles that hold it.