# Reset or rotate user token

**URL:** <https://community.sonatype.com/t/reset-or-rotate-user-token/13007>\
**Category:** Sonatype Nexus Repository\
**Created:** [August 6, 2024, 2:05pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007 "2024-08-06T14:05:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 6, 2024, 2:05pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/1 "2024-08-06T14:05:33Z")

</div>

Hi,

I’m doing a POC on Nexus Sonatype, so far so good on overall capabilities of the repository, the proxy, group and hosted. All nice but there’s not much information on the token reset or rotate, which is important now a days with security, there’s a link here,

[https://help.sonatype.com/en/user-tokens.html](https://help.sonatype.com/en/user-tokens.html)

but there’s no CLI equivalent, and all similar link don’t have proper answer on how to really reset/rotate it using CLI. Even the creation CLI is not happening with my trial of 10 days.

Let me know if this is really possible so that I can recommned this product to be purchased with my company.

Thanks,  
Ric

---

<div class="post-metadata">

**Author:** ![glee](https://avatars.discourse-cdn.com/v4/letter/g/b5a626/32.png) [@glee](https://community.sonatype.com/u/glee)\
**Post date:** [August 8, 2024, 3:43pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/2 "2024-08-08T15:43:41Z")

</div>

Hi Ric,

Thanks a lot for taking the time to do a POC and providing your feedback. Much appreciated! For user tokens, enabling/disabling, invalidating, checking capability status are all available with REST API:

 ![image](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/c/cb99e478a9be4d60eaa84baa4f9d52dd5f3b8f5e.png)

Rotating and resetting aren’t currently available with REST API. Can you please provide a bit more details on your user case? I can bring this back to our account team to address your concern.

Best regards,  
Grace

---

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 8, 2024, 3:51pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/3 "2024-08-08T15:51:39Z")

</div>

I’m inspecting the chrome on the “Reset User Token”, after I click it, it will reset the token and on the inspection/network, I will have this,

[http://nexus-vm:8081/service/rest/internal/current-user/user-token?authToken=TC1QQnJhSXE6R0RsMmJoM2R2bWhrdzFGandqVEctQlB2c01JVVluZllPankxNzN2SklnSko==&\_dc=1723131349520](http://nexus-vm:8081/service/rest/internal/current-user/user-token?authToken=TC1QQnJhSXE6R0RsMmJoM2R2bWhrdzFGandqVEctQlB2c01JVVluZllPankxNzN2SklnSko==&_dc=1723131349520)

Now the authToken is new, if you click the “Access User Token”, there are only usertoken and passcodetoken and the base64 converted token.

So how can we get this authToken? If I get this, then it should work, right? Or it is really disabled?

---

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 12, 2024, 2:21pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/4 "2024-08-12T14:21:48Z")

</div>

Even if the api is not available, it can be access inside the vm, the reason I’m familiar with this kind of approach, I did this with prometheus/openshift, the company I work before don’t have budget for metrics on container, the only they could do is someon who could retrieve it from prometheus, so even if there’s no api available since it will be executed inside (using ansible) vm, I could retrieve if by debugging thru chrome and getting the endpoint, but since we have already license with openshift/prometheus, there’s no problem asking for calculation on the session token, see below,

> <https://github.com/rv-openshift/dora/blob/main/library/get_metrics.py>

This is not REST-API but actual program-API. Hopefully you could give that authToken calculation on epoch, user-token, or others like ip?

Thanks.

---

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 16, 2024, 1:34pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/5 "2024-08-16T13:34:08Z")

</div>

I think I remember using Okta token integration will work?

---

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 23, 2024, 8:05pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/6 "2024-08-23T20:05:41Z")

</div>

My bad, the delete will do and create a new one or PUT.

---

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 23, 2024, 8:16pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/7 "2024-08-23T20:16:51Z")

</div>

But this,

```auto
[ric@nexus-vm ~]$ curl -kv -X 'GET' 'http://nexus-vm:8081/service/rest/v1/security/user-tokens' -H 'accept: application/json' -H 'NX-ANTI-CSRF-TOKEN: 0.5420273197246628' -H 'X-Nexus-UI: true'
Note: Unnecessary use of -X or --request, GET is already inferred.
* Trying 192.168.133.113...
* TCP_NODELAY set
* Connected to nexus-vm (192.168.133.113) port 8081 (#0)
> GET /service/rest/v1/security/user-tokens HTTP/1.1
> Host: nexus-vm:8081
> User-Agent: curl/7.61.1
> accept: application/json
> NX-ANTI-CSRF-TOKEN: 0.5420273197246628
> X-Nexus-UI: true
>
< HTTP/1.1 403 Forbidden
< Date: Fri, 23 Aug 2024 20:14:27 GMT
< Server: Nexus/3.62.0-01 (PRO)
< X-Content-Type-Options: nosniff
< X-Siesta-FaultId: 8a17a192-aef6-452a-8ebf-54cb9596ffd7
< Content-Length: 0
<
* Connection #0 to host nexus-vm left intact

```

Execute only in Nexus Sonatype UI? Even on the vm doesn’t execute?

 ![image](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/7/75929f00366ce163c3ef6c34a49947a7822c6c6e.png)

---

<div class="post-metadata">

**Author:** ![venerayan](https://avatars.discourse-cdn.com/v4/letter/v/45deac/32.png) [@venerayan](https://community.sonatype.com/u/venerayan)\
**Post date:** [August 23, 2024, 8:58pm UTC](https://community.sonatype.com/t/reset-or-rotate-user-token/13007/8 "2024-08-23T20:58:22Z")

</div>

This works,

```auto

[ric@nexus-vm ~]$ curl -kv -X 'DELETE' 'http://3sIzGUp6:XjePi6rAr2fzheQF7POvAS_Eg7-R718QOLDTsfpKCrgW@nexus-vm:8081/service/rest/v1/security/user-tokens' -H 'accept: application/json' -H 'NX-ANTI-CSRF-TOKEN: 0.5420273197246628' -H 'X-Nexus-UI: true'
* Trying 192.168.133.113...
* TCP_NODELAY set
* Connected to nexus-vm (192.168.133.113) port 8081 (#0)
* Server auth using Basic with user '3sIzGUp6'
> DELETE /service/rest/v1/security/user-tokens HTTP/1.1
> Host: nexus-vm:8081
> Authorization: Basic M3NJekdVcDY6WGplUGk2ckFyMmZ6aGVRRjdQT3ZBU19FZzctUjcxOFFPTERUc2ZwS0NyZ1c=
> User-Agent: curl/7.61.1
> accept: application/json
> NX-ANTI-CSRF-TOKEN: 0.5420273197246628
> X-Nexus-UI: true
>
< HTTP/1.1 204 No Content
< Date: Fri, 23 Aug 2024 20:57:46 GMT
< Server: Nexus/3.62.0-01 (PRO)
< X-Content-Type-Options: nosniff
<
* Connection #0 to host nexus-vm left intact
[ric@nexus-vm ~]$

```