API tokens with expiration date by mawinter69 · Pull Request #23859 · jenkinsci/jenkins

mawinter69 · 2025-11-25T22:10:59Z

API tokens can now get an optional expiration date. Added a select drop down from where you can choose from predefined durations (default is 30 days), a custom date (max 1 year in the selector from the date input field) and no expiration. Expiration date is shown in the list. Not expiring tokens and tokens that expire in less than 7 days are marked with warning, expired tokens are marked with error.
The sidepanel on the user page now has a badge for the security action when there are tokens that expired or are about to expire. In the header the user avatar has a badge and in the dropdown is a badge.

Fixes #16695

Testing done

Interactive testing for the UI part
Added tests for the scripting part, ensuring that expired tokens are not accepted

Proposed changelog entries

API tokens with expiration date

Proposed changelog category

/label rfe

Proposed upgrade guidelines

N/A

Submitter checklist

[ ´x] The issue, if it exists, is well-described.
[ ]xThe changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developers, depending on the change) and are in the imperative mood (see examples). Fill in the Proposed upgrade guidelines section only if there are breaking changes or changes that may require extra steps from users during upgrade.
There is automated testing or an explanation as to why this change has no tests.
New public classes, fields, and methods are annotated with @Restricted or have @since TODO Javadocs, as appropriate.
New deprecations are annotated with @Deprecated(since = "TODO") or @Deprecated(forRemoval = true, since = "TODO"), if applicable.
UI changes do not introduce regressions when enforcing the current default rules of Content Security Policy Plugin. In particular, new or substantially changed JavaScript is not defined inline and does not call eval to ease future introduction of Content Security Policy (CSP) directives (see documentation).
For dependency updates, there are links to external changelogs and, if possible, full differentials.
For new APIs and extension points, there is a link to at least one consumer.

Desired reviewers

@mention

Before the changes are marked as ready-for-merge:

Maintainer checklist

There are at least two (2) approvals for the pull request and no outstanding requests for change.
Conversations in the pull request are over, or it is explicit that a reviewer is not blocking the change.
Changelog entries in the pull request title and/or Proposed changelog entries are accurate, human-readable, and in the imperative mood.
Proper changelog labels are set so that the changelog can be generated automatically.
If the change needs additional upgrade steps from users, the upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the pull request title (see example).
If it would make sense to backport the change to LTS, be a Bug or Improvement, and either the issue or pull request must be labeled as lts-candidate to be considered.

API tokens can now get an optional expiration date. Added a select drop down from where you can choose from predefined durations, a custom date (max 1 year) and no expiration. Expiration date is shown in the list. Not expiring tokens are marked with warning. fixes jenkinsci#16695

mawinter69 · 2025-11-25T22:22:50Z

The SetupWizard allows to generate an API Token. Should that be automatically an expiring token maybe?

timja · 2025-11-26T08:55:12Z

The SetupWizard allows to generate an API Token. Should that be automatically an expiring token maybe?

how do you generate one in the setup wizard?

core/src/main/resources/jenkins/security/ApiTokenProperty/config.properties

lemeurherve · 2025-11-26T14:35:07Z

Would it be possible/desirable to have even shorter periods like 1 hour? I'm thinking about tokens that could be used for short-lived jobs.

lemeurherve · 2025-11-26T14:40:10Z

core/src/main/java/jenkins/security/ApiTokenProperty.java

            this.isLegacy = token.isLegacy();
+            LocalDate expirationDate = token.getExpirationDate();
+            if (expirationDate == null) {
+                this.expirationDate = "never";


That would be a breaking change maybe for later, but how about having a short-lived token generated by default instead of an eternal one to prevent mistakes, and to ensure eternal token creation is a conscencious and deliberate choice?

(EDIT: The line I put this comment on isn't the proper one, sorry)

In the UI the default is set to 30 days.

novinxy · 2025-11-26T18:04:21Z

What is default expiration ? Is it "never" or some sane time like 1 month ?
What happens near expiration ? Is there some notification(on UI or mail) before , e.g. week before? It would be shame to expire without notificating user in advance

mawinter69 · 2025-11-26T18:31:24Z

The SetupWizard allows to generate an API Token. Should that be automatically an expiring token maybe?

how do you generate one in the setup wizard?

You can set a system property then it generates an api token or uses a given one. See

jenkins/core/src/main/java/jenkins/install/SetupWizard.java

Line 104 in 46b6e75

/**

mawinter69 · 2025-11-26T18:37:05Z

Would it be possible/desirable to have even shorter periods like 1 hour? I'm thinking about tokens that could be used for short-lived jobs.

Technically possible, though not sure how much sense this makes. How do you get to this token? You would need to use your password in some way or another token. And by default I think even the SYSTEM account is not able to generate new token for a user.
What would be a nice feature but that would require major refactoring is to have tokens with reduced permissions. E.g. you have build permissions for a user but want to create a token that has only read permissions and not build.

mawinter69 · 2025-11-26T18:50:55Z

What is default expiration ? Is it "never" or some sane time like 1 month ? What happens near expiration ? Is there some notification(on UI or mail) before , e.g. week before? It would be shame to expire without notificating user in advance

In the UI I set the default to 30 days. Notifications make sense. Maybe I can add some badge to the user icon in the header to inform about expiring tokens.
Sending mail notification is not possible out of the box as there is no support for mail sending in core. You need at least the mailer plugin

timja · 2025-11-26T21:52:35Z

Sending mail notification is not possible out of the box as there is no support for mail sending in core. You need at least the mailer plugin

Could be an extension point but probably not worth it? Those emails just annoy me I've intentionally set it short for a one-off / temporary thing don't bug me about it

mawinter69 · 2025-11-28T19:37:10Z

Sending mail notification is not possible out of the box as there is no support for mail sending in core. You need at least the mailer plugin

Could be an extension point but probably not worth it? Those emails just annoy me I've intentionally set it short for a one-off / temporary thing don't bug me about it

When you have tokens that run for several month some kind of notification besides an icon might be useful. I see the main purpose of the expiring tokens when a user wants to do some experiments. For automation purposes I would anyway assume that those are usually technical users where an email address might not be available and where hardly anyone logs on in the UI in Jenkins. So they will probably stick to not expiring tokens.

mawinter69 · 2025-11-28T19:38:30Z

Should expired tokens be automatically removed? Instantly, after a week, configurable or never?

timja · 2025-11-29T21:38:05Z

Should expired tokens be automatically removed? Instantly, after a week, configurable or never?

I would leave them, most systems I can think of leave them around.

timja · 2026-01-22T22:55:46Z

The balance of this feels a bit off:

Adding a third line really throws off alignment, especially with the buttons being on the middle line.
Do we need the created date at all? Isn't last used more important?

Date format is inconsistent:

Date picker appears to use a locale based format, where-as the two places the date is shown are using YYYY-MM-DD.
Ideally it would display in a locale specific format, I think there's a tag for that, i:formatDate?

Apart from above looks great.

mawinter69 · 2026-01-23T14:28:14Z

Date picker appears to use a locale based format, where-as the two places the date is shown are using YYYY-MM-DD. Ideally it would display in a locale specific format, I think there's a tag for that, i:formatDate?

the date picker is the browser-built-in. So I'm not able to change that. i:formatDate (which I can't use as it only works with Date but I use LocalDate) and also the DateTimeFormatter with style short produces strings with 2 digit years and without leading zeros for english locale, e.g. 2/23/26 so this is also not 100% in sync.
I could also incorporate flatpickr to get a better styled date picker. It's vanilla js, works fine and added it in plugins already though it is not that well maintained (last commit 4 years ago).

mawinter69 · 2026-01-23T14:56:33Z

How about this:

That removes the creation string. Adding the creation timestamp as a tooltip to the span with the expiration

timja · 2026-01-23T16:36:56Z

That looks better

timja · 2026-01-23T16:37:29Z

Date picker appears to use a locale based format, where-as the two places the date is shown are using YYYY-MM-DD. Ideally it would display in a locale specific format, I think there's a tag for that, i:formatDate?

the date picker is the browser-built-in. So I'm not able to change that. i:formatDate (which I can't use as it only works with Date but I use LocalDate) and also the DateTimeFormatter with style short produces strings with 2 digit years and without leading zeros for english locale, e.g. 2/23/26 so this is also not 100% in sync. I could also incorporate flatpickr to get a better styled date picker. It's vanilla js, works fine and added it in plugins already though it is not that well maintained (last commit 4 years ago).

Can you convert from LocalDate to date then use it?
That format looks better than what's there now.

mawinter69 · 2026-01-23T16:52:12Z

I actually do the locale formatting already in Java now. And working with the Date class is not really nice.

make the creation date a tooltip of the expiration

mawinter69 · 2026-01-23T17:00:51Z

Do we need some kind of admin monitor for tokens that are about to expire or have expired? That might be useful when api tokens with expiration date are set for technical users, where usually nobody logs in via the UI.

timja · 2026-01-23T17:25:17Z

Do we need some kind of admin monitor for tokens that are about to expire or have expired? That might be useful when api tokens with expiration date are set for technical users, where usually nobody logs in via the UI.

I don’t think so. Not for user tokens.

some systems have the concept of system or resource owner tokens where ownership isn’t by an individual so that when someone leaves they don’t break and it might make sense there but I don’t think it makes sense at an individual level. Maybe there could be a page listing API tokens and their statuses.

An admin monitor shouldn’t be for a normal everyday activity though of expiring tokens

janfaracik · 2026-01-23T17:28:01Z

Looking great - couple points:

Dialog width changes when you change to a custom expiration date
The expiration date looks good, might work better in a slightly smaller font, e.g. var(--font-size-xs) and maybe a secondary text colour for distant dates

mawinter69 · 2026-01-23T19:47:57Z

made the dialog larger so it should not change width
reduced font size for expiration

timja · 2026-01-23T22:20:34Z

core/src/main/resources/jenkins/security/ApiTokenProperty/resources.js

+  dateInput.min = now.toISOString().split("T")[0];
+  dateInput.max = nextYear.toISOString().split("T")[0];
+  dateInput.value = presetDate.toISOString().split("T")[0];
+  form.appendChild(formTemplate);


not sure if worth fixing, but when a new api token is added to the list it is always added to the bottom.

but when you refresh the page the tokens are sorted alphabetically.
Bit strange that they jump around

That hasn't changed. It was like that before.

core/src/main/resources/jenkins/security/ApiTokenProperty/config.properties

timja · 2026-01-23T22:24:07Z

core/src/main/resources/jenkins/security/ApiTokenProperty/config.jelly

+                        <option value="never">No Expiration</option>
+                    </select>
+                </div>
+                <input type="date" name="tokenExpiration" class="jenkins-hidden jenkins-input token-expiration-date"/>


this should have a min set to today and it should be validated server side that the expiry is not in the past.

Convenient for testing but I don't think it should be allowed.

I programmatically set min and max in javascript. Which is properly applied in the picker but that doesn't prevent you from manually changing the date to something in the past directly in the input field.
I can add validation in java

added a validation on server side. When in the past the token is not added and an alert is shown

Interestingly in Chrome when you select the year and then use the arrow up/down buttons, it respects the limits from minand max. Firefox does not.

It only respects the year weirdly with up and down buttons. I tested by adjusting the month to later in the year and I can adjust day and month into the past and just type a date in the past too.

Good enough I guess, unless we want to add client side validation too

timja

Overall it LGTM.

I added a few nits that would be good to improve, but they aren't blockers to me.

don't add token when choosing date in the past directly warn after creation when about to expire

janfaracik

Thanks for the changes :) LGTM.

timja

Re-tested, changes looks good

/label ready-for-merge

This PR is now ready for merge, after ~24 hours, we will merge it if there's no negative feedback.

Thanks!

* API tokens with expiration API tokens can now get an optional expiration date. Added a select drop down from where you can choose from predefined durations, a custom date (max 1 year) and no expiration. Expiration date is shown in the list. Not expiring tokens are marked with warning. fixes jenkinsci#16695 * revert changes in SetupWizard * fix linter * fix ordering * show when token expired * notify on expiring and expired tokens * format * 2 lines only make the creation date a tooltip of the expiration * feedback * feedback 2 don't add token when choosing date in the past directly warn after creation when about to expire * prettier --------- Co-authored-by: Tim Jacomb <timjacomb1@gmail.com>

comment-ops-bot bot added the rfe For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted label Nov 25, 2025

mawinter69 changed the title ~~API tokens with expiration~~ API tokens with expiration date Nov 25, 2025

revert changes in SetupWizard

eb69c85

mawinter69 added 2 commits November 25, 2025 23:32

fix linter

5f89a59

fix ordering

48082c9

timja reviewed Nov 26, 2025

View reviewed changes

core/src/main/resources/jenkins/security/ApiTokenProperty/config.properties Show resolved Hide resolved

lemeurherve reviewed Nov 26, 2025

View reviewed changes

mawinter69 marked this pull request as draft November 26, 2025 18:38

show when token expired

5d18201

notify on expiring and expired tokens

24d2292

Merge branch 'master' into expiring-tokens

19b02b5

mawinter69 marked this pull request as ready for review November 29, 2025 21:05

format

c7bb0bb

daniel-beck self-requested a review December 3, 2025 21:20

Merge branch 'master' into expiring-tokens

3d3dfe4

lemeurherve mentioned this pull request Dec 19, 2025

Renew ci.jenkins.io API token for incremental-publisher service before 10 January 2026 jenkins-infra/helpdesk#4920

Closed

8 tasks

Merge branch 'master' into expiring-tokens

df6bd2f

janfaracik self-requested a review January 23, 2026 11:37

2 lines only

273a580

make the creation date a tooltip of the expiration

feedback

dda1102

timja reviewed Jan 23, 2026

View reviewed changes

timja approved these changes Jan 23, 2026

View reviewed changes

mawinter69 added 2 commits January 24, 2026 10:56

feedback 2

b7108cb

don't add token when choosing date in the past directly warn after creation when about to expire

prettier

d3807f6

janfaracik approved these changes Jan 24, 2026

View reviewed changes

timja approved these changes Jan 24, 2026

View reviewed changes

comment-ops-bot bot added the ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback label Jan 24, 2026

MarkEWaite merged commit 5490f91 into jenkinsci:master Jan 26, 2026
18 checks passed

mawinter69 mentioned this pull request Feb 3, 2026

Implement snooze functionality for administrative monitors with… #26244

Open

Uh oh!

Conversation

mawinter69 commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing done

Proposed changelog entries

Proposed changelog category

Proposed upgrade guidelines

Submitter checklist

Desired reviewers

Maintainer checklist

Uh oh!

mawinter69 commented Nov 25, 2025

Uh oh!

timja commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

lemeurherve commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lemeurherve Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

novinxy commented Nov 26, 2025

Uh oh!

mawinter69 commented Nov 26, 2025

Uh oh!

mawinter69 commented Nov 26, 2025

Uh oh!

mawinter69 commented Nov 26, 2025

Uh oh!

timja commented Nov 26, 2025

Uh oh!

mawinter69 commented Nov 28, 2025

Uh oh!

mawinter69 commented Nov 28, 2025

Uh oh!

timja commented Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timja commented Jan 22, 2026

Uh oh!

mawinter69 commented Jan 23, 2026

Uh oh!

mawinter69 commented Jan 23, 2026

Uh oh!

timja commented Jan 23, 2026

Uh oh!

timja commented Jan 23, 2026

Uh oh!

mawinter69 commented Jan 23, 2026

Uh oh!

mawinter69 commented Jan 23, 2026

Uh oh!

timja commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

janfaracik commented Jan 23, 2026

Uh oh!

mawinter69 commented Jan 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mawinter69 commented Nov 25, 2025 •

edited

Loading

timja commented Nov 26, 2025 •

edited

Loading

lemeurherve commented Nov 26, 2025 •

edited

Loading

lemeurherve Nov 26, 2025 •

edited

Loading

timja commented Nov 29, 2025 •

edited

Loading

timja commented Jan 23, 2026 •

edited

Loading

timja left a comment •

edited

Loading