Find the id of the user who granted OAuth2 access

3 replies
277 views

I’m currently trying to understand whether there’s a way to determine which user granted the OAuth token I’m using in the request?

I’ve found the `API Token Details`, but that appears to only expose company-level information.

Could I achieve this by introspecting the JWT claims? (e.g. `sub`?)

OAuth

jasonAnswer

Fronteer

Hi Scott,

In short - no. JWTs are authorized by a teammate, but the token itself is not linked to a teammate in any way - it’s a company-level resource.

It’s worth noting that only your global admins can authorize OAuth tokens to be created, so that should narrow down your search.

jasonAnswer

Fronteer

Hi Scott,

In short - no. JWTs are authorized by a teammate, but the token itself is not linked to a teammate in any way - it’s a company-level resource.

It’s worth noting that only your global admins can authorize OAuth tokens to be created, so that should narrow down your search.

manish

Conversationalist

hey Jason, is this answer still valid today because i happen to run into same blocker?

jason

Fronteer

Yes - still valid today. OAuth access is still granted at a “company” level, so it can not presently be used identify any one teammate.

I did raise this as a feature request at https://front.ideas.aha.io/ideas/PRD-I-9103 - I’d suggest heading there and giving it a +1 vote to register your interest, and leave any relevant comments about why it would be a useful feature for your team!

Sign up

Use your Front credentials

Login to the community

Use your Front credentials