API Token expires without any notification. How to prevent that?

[Abhi Srivastava]

Hi team,
Greetings!

At times, the API token expires without giving any notification. It has been at two scenarios:
1.) While trying forge login command in CLI: it gives cannot login invalid credentials, then I went to check my token it was revoked automatically. I created new and tried forge login with new token it worked.

2.) While developing forge application: we were using the rest api and while using that we were passing email id and token as basic auth but I was getting error as “Uncaught (in promise) Error: There was an error invoking the function - Unexpected token < in JSON at position 0”

I am aware that the API token has no expiration until we revoke, but I am unable to get why my token expires. Even if it expires it does not give any email notification.
Could you please guide us on this.

[Mahtab · Accepted solution]

Hi team,

By design, the User API tokens do not expire by default (This will however change soon per the new announcements from Atlassian )

So for the existing APIs that has been created to this date, when we set them up, there is no expiration date to be selected, and they are valid until they are intentionally revoked. Source: View user API tokens

 The main reason if the token would get revoked by Atlassian is if they are being used in public spaces as described in the following documentation: 

• API tokens are revoked automatically when used in public spaces

 Referring to Understand user API tokens , your org admin can also manage the user tokens and revoke if they see it necessary. So that is another possibility as we have seen org admins try to clean up user tokens without consulting with their users.  

https://admin.atlassian.com/o/ORGID/api-tokens

Hope this helps

[Jesse Lambertson _IU_]

Curious, is there a way to get notifications for API user tokens before they expire?  Thank you

[Tom Davies]

having only the User API token page https://admin.atlassian.com/ isn't the best. We have several API's that are attached to some api users. Having to manually check in the https://admin.atlassian.com/ isn't ideal. Surely there is an alert of some sort that can be created? Even an email would suffice for now

[Jesse Lambertson _IU_]

agreed