Administrator API tokens
Deployments that provision accounts programmatically can now authenticate to
the admin API without an interactive login. An administrator issues a bearer
token from their session; it manages accounts (list, create, disable, enable,
reset password) and nothing else.
A token holds strictly less authority than the session that issued it. It
cannot create an administrator, write to an account that is one, clear a
second factor, or mint another token. Tokens are stored hashed, revocable
individually with effect on the next request, and are made inert immediately
if the issuing account is disabled, demoted or deleted. A password change no
longer revokes them, so automation survives credential rotation.
See docs/auth.md.
What's Changed
- Add administrator API tokens by @jasonmadigan in #206
Full Changelog: 0.9.0...0.9.1