Personal access tokens

[ditschedev]

Is there a way to add a personal access token to hydra usign the API? Or is that the responsability of the Idp / resource server?

[aeneasr]

PATs are not OAuth2 because they are not initiated by a third party but instead by the user themselves! We do have plans for such a service though, but development won’t start before next year. Hope this helps :)

[ditschedev]

Thanks for the quick reply. What would you suggest to do in the meantime? We have two Services that we want to integrate with Hydra for SSO. For accessing the API the users should be able to issue personal access tokens. I would have stored them in the service, where it was created (hashed in the database with the granted scopes) and extended my authentication middleware to check first in the database and then to the token introspection at hydra.

Is that secure by design? Or am I missing something?

[aeneasr]

That sounds good :)

[hiendaovinh]

Hey @aeneasr, do we have the status of this feature?
Thank you!

[kmherrmann]

Hello, thanks for checking - we will make changes to PAKs and API access permissions in the coming months to allow for more granular access control.
What is it exactly that you're after?