Skip to main content

User Tokens API

If you’re a Nexus Repository administrator, you can use the user tokens REST API to create and manage tokens for your team. Use the following endpoints to create user tokens, check token metadata, list and delete tokens when you no longer need them. For more details on the example responses, refer to Nexus Repository API Reference documentation.

Create a User Token

The following endpoint creates a user token for the specified userId and realm using the system’s default expiration settings. Note that passCode is displayed only at the time of creation and should be stored securely.

POST /service/rest/v1/security/users/{userId}/{realm}/user-token

Path Parameters:

  • userId: Target user identifier

  • realm: Authentication realm. For realm IDs, see Available Realms.

Note

Nexus Repository does not log passCode. Users are advised to store their passCode in a secure location.

Get User Token Metadata

The following endpoint retrieves metadata for the specified userId and realm. It returns only the metadata.

GET /service/rest/v1/security/users/{userId}/{realm}/user-token

Path Parameters:

  • userId: Target user identifier

  • realm: Authentication realm. For realm IDs, see Available Realms.

List all User Tokens

The following endpoint retrieves a paginated list of user tokens. It uses filters such as realm, userId, and includeExpired, along with pagination controls like skip and limit, to narrow results and manage large token inventories.

GET /service/rest/v1/security/user-tokens/tokens

Path Parameters:

  • realm: The realm of the user (optional for cloud, required for self-hosted). It returns token filtered to the specified realm. For realm IDs, see Available Realms.

    GET /service/rest/v1/security/user-tokens/tokens?realm=<realmId>

  • userId: Filter by user ID (optional)

  • includeExpired: Include expired tokens (default: false)

  • skip: Number of items to skip for pagination (default: 0)

  • limit: Maximum number of items to return (default: 25, max: 100)

  • nameCode: Filters user tokens by the token nameCode. This is useful to look up the owning userId and realm for a specific user token. This parameter does not expose token secrets. This parameter is available from 3.93 in self-hosted deployments.

    GET /service/rest/v1/security/user-tokens/tokens?nameCode=<token-name-code>

    Note

    The lowercase namecode query parameter continues to be accepted for backward compatibility. Use nameCode for new requests.

Delete a User Token

Permanently deletes the user token for the specified userId and realm, immediately revoking access that depends on that token. After deletion, a new token can be created again for that user/realm.

DELETE /service/rest/v1/security/users/{userId}/{realm}/user-token

Path Parameters:

  • userId: Target user identifier

  • realm: Authentication realm. For realm IDs, see Available Realms.

Note

The existing endpoint DELETE/service/rest/v1/security/users/{userId}/{realm}/user-token-reset is depcreated but still works for backward compatibility.