Skip to content

docs(tokens): approving a desktop app sign-in needs Create Token in any of your organizations #1348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leecalcote merged 1 commit into from
Oct 19, 2026
Merged

docs(tokens): approving a desktop app sign-in needs Create Token in any of your organizations #1348

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/en/cloud/concepts/identity-and-security/tokens.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ Each action on the Tokens tab is governed by a [key]({{< ref "cloud/concepts/ide
Every token action applies only to your own tokens. You cannot list, download or delete another user's token.

{{< alert type="warning" title="Current behavior: token create and delete requests are not checked against the keys" >}}
The Layer5 Cloud server allows any signed-in user to create and delete their own tokens through the API. It does not check the Create Token or Delete Token keys on those requests. Withholding those keys hides the controls in the interface; it does not prevent a user from minting a token. Approving a desktop app or CLI sign-in is different: the server requires Create Token in the selected organization.
The Layer5 Cloud server allows any signed-in user to create and delete their own tokens through the API. It does not check the Create Token or Delete Token keys on those requests. Withholding those keys hides the controls in the interface; it does not prevent a user from minting a token. Approving a desktop app or CLI sign-in is different: the server requires Create Token in at least one organization you belong to. The organization you have selected, or the one a custom domain belongs to, does not matter, so a member of a child organization can approve a sign-in on its parent's custom domain.
{{< /alert >}}

The [security reference]({{< ref "cloud/reference/security.md" >}}) lists every security key and the roles that hold it.
Expand Down
Loading