# User Tokens API

If you’re a Nexus Repository administrator, you can use the user tokens REST API to create and manage tokens for your team. Use the following endpoints to create user tokens, check token metadata, list and delete tokens when you no longer need them. For more details on the example responses, refer to [Nexus Repository API Reference](https://help.sonatype.com/en/api-reference.html) documentation.

## Create a User Token

The following endpoint creates a user token for the specified `userId` and `realm` using the system’s default expiration settings. Note that `passCode` is displayed only at the time of creation and should be stored securely.

```
POST /service/rest/v1/security/users/{userId}/{realm}/user-token
```

**Path Parameters:**

- `userId`: Target user identifier
- `realm`: Authentication realm

**Note**  
Nexus Repository does not log `passCode`. Users are advised to store their `passCode` in a secure location.

## Get User Token Metadata

The following endpoint retrieves metadata for the specified `userId` and `realm`. It returns only the metadata.

```
GET /service/rest/v1/security/users/{userId}/{realm}/user-token
```

**Path Parameters:**

- `userId`: Target user identifier
- `realm`: Authentication realm

## List all User Tokens

The following endpoint retrieves a paginated list of user tokens. It uses filters such as `realm`, `userId`, and `includeExpired`, along with pagination controls like `skip` and `limit`, to narrow results and manage large token inventories.

```
GET /service/rest/v1/security/user-tokens/tokens
```

**Path Parameters:**

- `realm`: The realm of the user (optional for cloud, required for self-hosted). It returns token filtered to the specified realm.

```
GET /service/rest/v1/security/user-tokens/tokens?realm=<realmId>
```

- `userId`: Filter by user ID (optional)
- `includeExpired`: Include expired tokens (default: false)
- `skip`: Number of items to skip for pagination (default: 0)
- `limit`: Maximum number of items to return (default: 25, max: 100)
- `nameCode`: Filters user tokens by the token nameCode. This is useful to look up the owning `userId` and `realm` for a specific user token. This parameter does not expose token secrets. This parameter is available from 3.93 in self-hosted deployments.

## Delete a User Token

Permanently deletes the user token for the specified `userId` and `realm`, immediately revoking access that depends on that token. After deletion, a new token can be created again for that user/realm.

```
DELETE /service/rest/v1/security/users/{userId}/{realm}/user-token
```

**Path Parameters:**

- `userId`: Target user identifier
- `realm`: Authentication realm

**Note**  
The existing endpoint `DELETE/service/rest/v1/security/users/{userId}/{realm}/user-token-reset` is deprecated but still works for backward compatibility.

## Search results

No results found