how to revoke jupyterhub api tokens?

[Randy Lai]

Maybe someone has asked before, I tried searching but found nothing.

[MinRK]

It’s not easy or obvious, but this code will delete a token:

from jupyterhub import orm

db_url = 'sqlite:///jupyterhub.sqlite'

token = '...'

db = orm.new_session_factory(url=db_url)()
orm_token = orm.APIToken.find(db, token)
if orm_token is None:
    print("No token matching %s" % token)
else:
    print("Removing %s" % orm_token)
    db.delete(orm_token)
    db.commit()

this script does the same thing with a CLI.

We should probably add it as a jupyterhub token drop entrypoint.

It is my hope to get some token management UI into JupyterHub 0.9, with annotations for each token, e.g.

• note:”API token for randylai’s server”
• created: date
• last used: date
• user: name

where users and admins could audit and delete API tokens.

-MinRK

On Thu, Oct 5, 2017 at 6:17 PM, Randy Lai <randy....@gmail.com> wrote:

Maybe someone has asked before, I tried searching but found nothing.

--
You received this message because you are subscribed to the Google Groups "Project Jupyter" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jupyter+unsubscribe@googlegroups.com.
To post to this group, send email to jup...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/0245c425-ecbb-4f0a-ac78-f724e9147d1b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

​