# Create API Token that are "impersonating" a user

**URL:** <https://forum.keycloak.org/t/create-api-token-that-are-impersonating-a-user/8665>\
**Category:** Getting advice\
**Created:** [April 22, 2021, 1:20pm UTC](https://forum.keycloak.org/t/create-api-token-that-are-impersonating-a-user/8665 "2021-04-22T13:20:52Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![thomasmicro](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thomasmicro/32/4014_2.png) [@thomasmicro](https://forum.keycloak.org/u/thomasmicro)\
**Post date:** [October 6, 2021, 12:46pm UTC](https://forum.keycloak.org/t/create-api-token-that-are-impersonating-a-user/8665/2 "2021-10-06T12:46:04Z")

</div>

Hi!

I wrestle with the same question currently. A “nice to have” would be that the user can choose to restrict the API-Token.

Some of my thoughts (unfinished):

**Idea:**  
In some sense, the OAuth 2 client-credentials Flow seems perfect. The User-App exchanges the client\_credentials with short-lived access\_token, uses these to access the API. Before expiry, the App can request new access\_token the same way.

Service Accounts could be generated for each API-Token and they could be somehow linked to the user. Or client\_credentials could be added to the User Credential Store of an existing user. Some custom Keycloak-Extension will be necessary either way.

**Problem:**  
The Token generated for the App-Login are liked to itself as azp and not to e.g. our forum, … . This will make the normal authorization-flow unusable. Additionally the /userinfo-Endpoint seems to be nearly unpopulated for service accounts.

**Solution idea:**  
You will have to assign the azp to the service some way -

- fetch it from a Request-Parameter during client\_id validation
- store it with the token

According to [Stack Overflow](https://stackoverflow.com/questions/54099677/keycloak-uma-grant-type-tickets-for-service-accounts-do-not-seem-to-work-with-po) (and own testing with Version 15.0.2), you can assign a service-account a hardcoded protocol-mapper with azp as key and the App-ID you want to use the token with as value. I wonder however if this was intended as a feature and how future-proof this is. This will also populate the /userinfo Endpoint.

* * *

I haven’t really thought of how to link the API-Account and the normal account yet - so thats missing here.

**EDIT:** The [Token Exchange](https://www.keycloak.org/docs/latest/securing_apps/index.html#_token-exchange) is maybe also a way to consider - although I didn’t get it working, yet.

Anyway, API-Token seem to be a highly requested feature in IAM for which I haven’t found a satisfying solution (in combination with OIDC or SAML). ([a SO-Question by me](https://stackoverflow.com/questions/68803408/api-token-feature-in-iam-system), [another SO-Question](https://stackoverflow.com/questions/28538415/can-client-credentials-grant-access-token-be-mapped-to-a-user), [a Question in the Auth0 Community](https://community.auth0.com/t/how-to-generate-tokens-for-api-users/9496), [a question here](http://forum.keycloak.org/t/how-to-use-api-keys-with-keycloak/2390), …)

I welcome all advice! There is probably a lot of stuff I forgot to consider! (I’m pretty new to IAM)

Best regards!  
Thomas (too)

---

_[View the full topic](https://forum.keycloak.org/t/create-api-token-that-are-impersonating-a-user/8665)._